From facc0f2b15460a545151dfb324aa1ef66ccae695 Mon Sep 17 00:00:00 2001 From: silverwind Date: Thu, 22 Oct 2026 15:06:01 +0200 Subject: [PATCH] refactor: prevent out-of-bounds read (#39936) `IsReadmeFileExtension("readme", exts...)` panicked with `index out of range [6] with length 6` when `exts` had no empty extension. The only caller always passes one, so this was not reachable in practice. Fixes: https://github.com/go-gitea/gitea/security/quality/rules/go%2Findex-out-of-bounds Written by Claude. --- modules/util/path.go | 2 +- modules/util/path_test.go | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/util/path.go b/modules/util/path.go index 0883349a88e..5679fa3f595 100644 --- a/modules/util/path.go +++ b/modules/util/path.go @@ -360,7 +360,7 @@ func IsReadmeFileExtension(name string, ext ...string) (int, bool) { } } - if name[6] == '.' { + if len(name) > 6 && name[6] == '.' { return len(ext), true } diff --git a/modules/util/path_test.go b/modules/util/path_test.go index 74adc44a89c..cb38644479d 100644 --- a/modules/util/path_test.go +++ b/modules/util/path_test.go @@ -142,6 +142,10 @@ func TestMisc_IsReadmeFileName(t *testing.T) { assert.Equal(t, testCase.expected, ok) assert.Equal(t, testCase.idx, idx) } + + idx, ok := IsReadmeFileExtension("readme", ".md") + assert.False(t, ok) + assert.Zero(t, idx) } func TestCleanPath(t *testing.T) {