encoding/json/v2: Unmarshal panics on embedded fallback map beneath a nil unexported pointer

[nicholashusin]

This was originally reported to us as a security report. We do not see practical ways to exploit this, but it is nevertheless a bug worth fixing.

Minimal repro:

type hiddenFallback struct {
	Extra map[string]any `json:",embed"`
}

type destination struct {
	*hiddenFallback // nil unexported embedded pointer
}

func main() {
	var dst destination
	// Unmatched field "unmatched" routes to the embedded fallback, causing panic.
	err := json.Unmarshal([]byte(`{"unmatched": 1}`), &dst)
	fmt.Printf("err=%v dst=%+v\n", err, dst)
}

The same repro does not panic with GOEXPERIMENT=nojsonv2.

[prattmic]

cc @dsnet @neild @ChrisHines

[gabyhelp]

Related Issues

• encoding/json: cannot unmarshal into unexported embedded pointer types #21357 (closed)
• encoding/json/v2: `json:",embed"` is rejected on a Go-embedded field of map or jsontext.Value type #80992
• encoding/json: new panic when using nested embedded struct pointer that implements Unmarshaler #81244
• encoding/json: panic on embedded struct pointer that implements Unmarshaler #30148 (closed)
• encoding/json: embedded *struct implementing UnmarshalJSON is nil and panics on Unmarshal #36716 (closed)
• encoding/json: json.Unmarshal on embedded unexported structs panics #24152 (closed)
• encoding/json: panic when unmarshalling to struct with embedded struct pointer #30489 (closed)
• encoding/json: Unmarshal of "null" string into map will panic after assignment #10411 (closed)
• encoding/json: infinite recursion in Umarshaler on named pointer type with GOEXPERIMENT=jsonv2 #75361

Related Code Changes

• encoding/json/v2: allow fallbacks to use Go embedding

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[gopherbot]

Change https://go.dev/cl/828284 mentions this issue: encoding/json/v2: fix panic on nil embedded pointer in Unmarshal