yq/pkg/yqlib/operator_slice_test.go
Jan Dubois 1b549962b2 Fix panic on negative slice indices that underflow after adjustment
sliceArrayOperator adjusts negative indices by adding Content length,
but does not clamp the result. When the absolute value of a negative
index exceeds Content length (e.g. .[-99999:3] on a 3-element array),
the adjusted index remains negative and causes an out-of-bounds access
in the Content slice loop.

Extract the adjust-and-clamp logic into clampSliceIndex and use it for
both index positions.

Reproducer (panics before this fix, returns full array after):

    echo '[a, b, c]' | yq '.[-99999:3]'

Found by OSS-Fuzz via the lima project's FuzzEvaluateExpression target.
https://issues.oss-fuzz.com/issues/438776028

Signed-off-by: Jan Dubois <jan@jandubois.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-05 22:35:04 -07:00

140 lines
3.5 KiB
Go

package yqlib
import "testing"
var sliceArrayScenarios = []expressionScenario{
{
description: "Slicing arrays",
document: `[cat, dog, frog, cow]`,
expression: `.[1:3]`,
expected: []string{
"D0, P[], (!!seq)::- dog\n- frog\n",
},
},
{
description: "Slicing arrays - without the first number",
subdescription: "Starts from the start of the array",
document: `[cat, dog, frog, cow]`,
expression: `.[:2]`,
expected: []string{
"D0, P[], (!!seq)::- cat\n- dog\n",
},
},
{
description: "Slicing arrays - without the second number",
subdescription: "Finishes at the end of the array",
document: `[cat, dog, frog, cow]`,
expression: `.[2:]`,
expected: []string{
"D0, P[], (!!seq)::- frog\n- cow\n",
},
},
{
description: "Slicing arrays - use negative numbers to count backwards from the end",
document: `[cat, dog, frog, cow]`,
expression: `.[1:-1]`,
expected: []string{
"D0, P[], (!!seq)::- dog\n- frog\n",
},
},
{
description: "Inserting into the middle of an array",
subdescription: "using an expression to find the index",
document: `[cat, dog, frog, cow]`,
expression: `(.[] | select(. == "dog") | key + 1) as $pos | .[0:($pos)] + ["rabbit"] + .[$pos:]`,
expected: []string{
"D0, P[], (!!seq)::- cat\n- dog\n- rabbit\n- frog\n- cow\n",
},
},
{
skipDoc: true,
document: `[[cat, dog, frog, cow], [apple, banana, grape, mango]]`,
expression: `.[] | .[1:3]`,
expected: []string{
"D0, P[0], (!!seq)::- dog\n- frog\n",
"D0, P[1], (!!seq)::- banana\n- grape\n",
},
},
{
skipDoc: true,
description: "second index beyond array clamps",
document: `[cat]`,
expression: `.[:3]`,
expected: []string{
"D0, P[], (!!seq)::- cat\n",
},
},
{
skipDoc: true,
description: "first index beyond array returns nothing",
document: `[cat]`,
expression: `.[3:]`,
expected: []string{
"D0, P[], (!!seq)::[]\n",
},
},
{
skipDoc: true,
document: `[[cat, dog, frog, cow], [apple, banana, grape, mango]]`,
expression: `.[] | .[-2:-1]`,
expected: []string{
"D0, P[0], (!!seq)::- frog\n",
"D0, P[1], (!!seq)::- grape\n",
},
},
{
skipDoc: true,
document: `[cat1, cat2, cat3, cat4, cat5, cat6, cat7, cat8, cat9, cat10, cat11]`,
expression: `.[10:11]`,
expected: []string{
"D0, P[], (!!seq)::- cat11\n",
},
},
{
skipDoc: true,
document: `[cat1, cat2, cat3, cat4, cat5, cat6, cat7, cat8, cat9, cat10, cat11]`,
expression: `.[-11:-10]`,
expected: []string{
"D0, P[], (!!seq)::- cat1\n",
},
},
{
// Regression test for https://issues.oss-fuzz.com/issues/438776028
// Negative second index that underflows after adjustment must
// clamp to zero, yielding an empty sequence.
skipDoc: true,
document: `[a, b, c]`,
expression: `.[0:-99999]`,
expected: []string{
"D0, P[], (!!seq)::[]\n",
},
},
{
// First-index underflow: without clamping, the loop starts at a
// negative index and panics on Content access.
skipDoc: true,
document: `[a, b, c]`,
expression: `.[-99999:3]`,
expected: []string{
"D0, P[], (!!seq)::- a\n- b\n- c\n",
},
},
{
// Both indices underflow: both clamp to zero, yielding an empty
// sequence.
skipDoc: true,
document: `[a, b, c]`,
expression: `.[-99999:-99998]`,
expected: []string{
"D0, P[], (!!seq)::[]\n",
},
},
}
func TestSliceOperatorScenarios(t *testing.T) {
for _, tt := range sliceArrayScenarios {
testScenario(t, &tt)
}
documentOperatorScenarios(t, "slice-array", sliceArrayScenarios)
}