CSS: minify background property panic: index out of range

[RO-29]

With this CSS property, css minifier panics 😱

<td align="center" bgcolor="#355FFF" style="background: linear-gradient(-180deg, #355FFF 0%, #1F52FF 100%) 0% 0% / cover; padding: 0 15px;" valign="top">

Playground link: https://play.golang.org/p/J1upw5Uq3TM

Stack trace

panic: runtime error: index out of range [1] with length 1

goroutine 1 [running]:
github.com/tdewolff/minify/v2/css.(*cssMinifier).minifyProperty(0xc00011d698, 0x2d13, 0xc000114000, 0x1, 0x8, 0x0, 0x0, 0x0)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/css/css.go:669 +0x5e17
github.com/tdewolff/minify/v2/css.(*cssMinifier).minifyProperty(0xc00011d698, 0x100002d0a, 0xc000114000, 0x5, 0x8, 0xc000000001, 0xc000100073, 0x5)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/css/css.go:622 +0xa78
github.com/tdewolff/minify/v2/css.(*cssMinifier).minifyDeclaration(0xc00011d698, 0xc00010002c, 0xa, 0x5d4, 0xc00003b400, 0x11, 0x20, 0x12e9de0, 0x1)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/css/css.go:366 +0xc8b
github.com/tdewolff/minify/v2/css.(*cssMinifier).minifyGrammar(0xc00011d698, 0xc00000e400, 0x12fcb01)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/css/css.go:194 +0xd39
github.com/tdewolff/minify/v2/css.(*Minifier).Minify(0x14eea60, 0xc000060300, 0x135ee60, 0xc00000e3e0, 0x135ee40, 0xc00000e400, 0xc0000b4ba0, 0x0, 0x0)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/css/css.go:90 +0x130
github.com/tdewolff/minify/v2/css.Minify(0xc000060300, 0x135ee60, 0xc00000e3e0, 0x135ee40, 0xc00000e400, 0xc0000b4ba0, 0xc0000c85a0, 0x203000)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/css/css.go:51 +0x70
github.com/tdewolff/minify/v2.MinifierFunc.Minify(0x1313810, 0xc000060300, 0x135ee60, 0xc00000e3e0, 0x135ee40, 0xc00000e400, 0xc0000b4ba0, 0x20, 0x20)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/minify.go:29 +0x65
github.com/tdewolff/minify/v2.(*M).MinifyMimetype(0xc000060300, 0x14ee4a8, 0x8, 0x8, 0x135ee60, 0xc00000e3e0, 0x135ee40, 0xc00000e400, 0xc0000b4ba0, 0x0, ...)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/minify.go:159 +0x2f3
github.com/tdewolff/minify/v2/html.(*Minifier).Minify(0xc0000187b0, 0xc000060300, 0x135ece0, 0xc0000b4c90, 0x135f1e0, 0xc00000e3c0, 0x0, 0x0, 0x0)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/html/html.go:398 +0x1a95
github.com/tdewolff/minify/v2.(*M).MinifyMimetype(0xc000060300, 0xc0000187c0, 0x9, 0x10, 0x135ece0, 0xc0000b4c90, 0x135f1e0, 0xc00000e3c0, 0x0, 0x0, ...)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/minify.go:159 +0x2f3
github.com/tdewolff/minify/v2.(*M).Minify(0xc000060300, 0x12fd892, 0x9, 0x135ece0, 0xc0000b4c90, 0x135f1e0, 0xc00000e3c0, 0x9, 0x135ee00)
	/Users/rohit/go/pkg/mod/github.com/tdewolff/minify/v2@v2.5.1/minify.go:147 +0xce

[tdewolff]

Uff, bad one. Thanks, should be fixed now but will need some looking into in the future.

[RO-29]

thanks @tdewolff for such quick fix!

[RO-29]

@tdewolff there are no latest release since 17 jul, https://github.com/tdewolff/minify/releases

When do you plan to release next?

[pierrre]

@tdewolff did you try to run https://github.com/dvyukov/go-fuzz on the code ?

[tdewolff]

@RO-29 I'll put one out soon

@pierrre Good point, most of the code has seen broad coverages from go-fuzz, but the new changes to various packages haven't been tested so well yet. PS: looks like I found another bug.

[tdewolff]

New release v2.5.2 is out and contains two more bugfixes found by go-fuzz.