x/tools/txtar: Parse can panic with slice bounds out of range

[cor0ps]

What version of Go are you using (go version)?

$ go version
go version go1.16.4 windows/amd64

Does this issue reproduce with the latest release?

yes,this is because golang.org/x/tools/txtar, all version maybe reproduce.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
set GO111MODULE=auto
set GOARCH=amd64
set GOBIN=
set GOCACHE=C:\Users\x\AppData\Local\go-build
set GOENV=C:\Users\x\AppData\Roaming\go\env
set GOEXE=.exe
set GOFLAGS=
set GOHOSTARCH=amd64
set GOHOSTOS=windows
set GOINSECURE=
set GOMODCACHE=C:\Users\xxx\go\pkg\mod
set GONOPROXY=
set GONOSUMDB=
set GOOS=windows
set GOPATH=C:\Users\
set GOPRIVATE=
set GOPROXY=
set GOROOT=D:\Program Files\Go
set GOSUMDB=sum.golang.org
set GOTMPDIR=
set GOTOOLDIR=
set GOVCS=
set GOVERSION=go1.16.4
set GCCGO=gccgo
set AR=ar
set CC=gcc
set CXX=g++
set CGO_ENABLED=1
set GOMOD=
set CGO_CFLAGS=-g -O2
set CGO_CPPFLAGS=
set CGO_CXXFLAGS=-g -O2
set CGO_FFLAGS=-g -O2
set CGO_LDFLAGS=-g -O2
set PKG_CONFIG=pkg-config

What did you do?

https://play.golang.org/p/b-471BZeL9y

What did you expect to see?

program run ok

What did you see instead?

panic: runtime error: slice bounds out of range [3:2]

because reason is: strings.TrimSpace(string(data[len(marker) : len(data)-len(markerEnd)]))

len(marker)==3
len(data)-len(markerEnd)==2

maybe this have fix bugs match marker and markerEnd shoud not duplicate！！！

[cherrymui]

cc @jayconrod @bcmills @matloob

[jayconrod]

Reproduced. The file name in this example is empty. txtar.Parse cannot return an error, so it should probably not treat that line as a file separator.

[cor0ps]

Reproduced. The file name in this example is empty. txtar.Parse cannot return an error, so it should probably not treat that line as a file separator.

Hello ,Can I submit a CVE for this issues?

[jayconrod]

@cor0ps This doesn't appear to be a security vulnerability so I don't think there's any sense in opening a CVE.

If you think an issue is a security vulnerability, please report it to security@golang.org instead of the public issue tracker.

[gopherbot]

Change https://golang.org/cl/335270 mentions this issue: cmd/go: update txtar.Parse to ignore invalid file separators

[gopherbot]

Change https://golang.org/cl/336932 mentions this issue: txtar/archive: ignore invalid file separators

[gopherbot]

Change https://golang.org/cl/337352 mentions this issue: [dev.cmdgo] cmd: update x/tools and remove copy of txtar

[gopherbot]

Change https://golang.org/cl/341937 mentions this issue: cmd: update x/tools and remove copy of txtar