Port #817 from v2.9.4 to master - #818
Merged
Merged
Conversation
This commit fixes a bug that can only be encountered if a user app
registers a tag for an array or struct having uncomparable or interface{}
element type, and then tries to decode a CBOR map matching that
registered tag as a map key under specific conditions (see details below).
It is fixed by checking comparability of array and struct values
before inserting them as a map key.
Details
Although isHashableValue() correctly rejected slice, map, func, big.Int,
and cbor.Tag having uncomparable content, it failed to reject arrays and
structs whose element or field is uncomparable. This can cause a panic
when decoding a CBOR map if all of these conditions are met:
- The application registers a tag type of array or struct whose element or
field type is uncomparable or interface{}.
- CBOR map contains the registered tag with uncomparable content as map key.
- Destination type is an interface{}, map[interface{}]X, or a struct when
DupMapKey is DupMapKeyEnforcedAPF.
This commit fixes a bug that can only be encountered if a user app specifies a decoding destination Go map key that is a user-defined empty interface or a type with transitive interface, and then tries to decode a CBOR map with an uncomparable map key value into it. This is fixed by checking map key comparability for key type that is interface or contains transitive interface before inserting them as a map key. Details Previously, the map key comparability is only checked when Go map key type is "any", so uncomparable value can cause panic when inserting as map key if: - the destination map key type is a user-defined empty interface, or - the destination map key type is a comparable type transitively containing an interface (e.g. [1]any). The commit updates the map key comparability check gate from whether the map key type is "any" to whether the map key type's comparability can't be determined from the static type alone.
x448
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See v2.9.4 release notes and PR #817 for details.