x/text/secure/precis: panic parsing crafted input in nickAdditionalMapping.Transform()

[jitsu-net]

A remotely-triggerable panic (Denial of Service) exists in golang.org/x/text/secure/precis. A specific 3-byte input crashes the Nickname profile during transformation.

The issue is located in secure/precis/nickname.go within the nickAdditionalMapping.Transform method. It violates the transform.Transformer contract in two ways when the destination buffer (dst) is nearly full:

1. Missing Bounds Check: The code writes an inserted ASCII space (dst[nDst] = ' ') without verifying if nDst < len(dst).
2. Unconditional Advancement: On a short copy, the code advances nDst by the full rune size (nDst += size) even if fewer bytes were actually written. This causes nDst to exceed len(dst), resulting in an out-of-bounds slice when the caller (e.g., transform.doAppend) attempts to use the buffer.

Thanks to Omkhar Arasaratnam (GitHub: omkhar) for reporting this issue.

This is a PUBLIC track vulnerability and CVE-2026-56851.

[cagedmantis]

cc @mpvl

[gopherbot]

Change https://go.dev/cl/793360 mentions this issue: secure/precis: fix short destination buffer handling in Nickname profile

[mrkfrmn]

Keeping this open until we confirm whether this needs to be vendored into the Go root.