Go Wiki: Fuzzing trophy case

This page collects issues that have been discovered using Go’s native fuzzing.

Contributing

If native fuzzing uncovered a bug in your project, please consider adding it to this list by editing this Wiki page directly, or by reaching out to katie@golang.org with the bug you’d like to share.

Note: If you think the bug is a security issue, please report it responsibly to the respective team, and do not include it in this list until public disclosure.

Trophies

Standard Library

• go/scanner: inconsistent handling of NUL bytes in 1.17
• time: ParseDuration can panic on invalid input

Other projects

• go-yaml/yaml/v3: yaml.Unmarshal() crashes on “#\n - - QI\xd7”
• josephburnett/jd: crashes when validating JSON Patch test/replace operation
• josephburnett/jd: JSON Patch to void failing round-trip
• kokes/smda: nil pointer error
• kokes/smda: out of bounds error
• mvdan.cc/sh: syntax.Quote failed to quote the empty string
• mvdan.cc/sh: syntax.Quote misused \x escape sequences in mksh
• mvdan.cc/sh: syntax.Quote can’t quote the 0xFFFE and 0xFFFF runes in mksh
• pelletier/go-toml: index out of range error in expect function
• swaggest/form: panic on invalid keys in request
• yuin/goldmark: corner case errors
• DataDog/datadog-agent: fix edge case in tags normalization