Skip to content

fix: add bounds check in Row.matchAll to prevent slice panic#68

Open
Yanhu007 wants to merge 1 commit into
gobwas:masterfrom
Yanhu007:fix/row-matchall-bounds-check
Open

fix: add bounds check in Row.matchAll to prevent slice panic#68
Yanhu007 wants to merge 1 commit into
gobwas:masterfrom
Yanhu007:fix/row-matchall-bounds-check

Conversation

@Yanhu007
Copy link
Copy Markdown

Fixes #59

Problem

Row.matchAll computes idx+next+1 as the slice end without checking if it exceeds len(s). With certain compiled patterns, this causes a panic:

gg, _ := glob.Compile("/{a{*.json{", '/')`
gg.Match("/a/b/c/d/e/foo.json")
// panic: runtime error: slice bounds out of range [:6] with length 5

Fix

Add a bounds check before slicing:

end := idx + next + 1
if i < length || end > len(s) || !m.Match(s[idx:end]) {
    return false
}

Row.matchAll could panic with "slice bounds out of range" when
the computed end index exceeded the string length. This happened
with certain malformed glob patterns like "/{a{*.json{" matched
against valid paths.

Add a bounds check before slicing to prevent the panic.

Fixes gobwas#59
@Yanhu007 Yanhu007 force-pushed the fix/row-matchall-bounds-check branch from 320a73e to a177d70 Compare April 14, 2026 08:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash in match.Row.matchAll

1 participant