From b6a90110a3bf32b68d27477c96f540a7fbfb536f Mon Sep 17 00:00:00 2001 From: Billy Keyes Date: Thu, 9 Sep 2021 14:24:16 -0400 Subject: [PATCH] Fix out-of-bounds panic parsing timestamps (#28) Found by go-fuzz. --- gitdiff/file_header.go | 2 +- gitdiff/file_header_test.go | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/gitdiff/file_header.go b/gitdiff/file_header.go index e3185bd..58904b4 100644 --- a/gitdiff/file_header.go +++ b/gitdiff/file_header.go @@ -527,7 +527,7 @@ func hasEpochTimestamp(s string) bool { // a valid timestamp can have optional ':' in zone specifier // remove that if it exists so we have a single format - if ts[len(ts)-3] == ':' { + if len(ts) >= 3 && ts[len(ts)-3] == ':' { ts = ts[:len(ts)-3] + ts[len(ts)-2:] } diff --git a/gitdiff/file_header_test.go b/gitdiff/file_header_test.go index 99cfed3..102795c 100644 --- a/gitdiff/file_header_test.go +++ b/gitdiff/file_header_test.go @@ -724,6 +724,14 @@ func TestHasEpochTimestamp(t *testing.T) { Input: "+++ file.txt\t2019-03-21 12:34:56.789 -0700\n", Output: false, }, + "notTimestamp": { + Input: "+++ file.txt\trandom text\n", + Output: false, + }, + "notTimestampShort": { + Input: "+++ file.txt\t0\n", + Output: false, + }, } for name, test := range tests {