common/uuid: fix panic when parsing 32-len invalid UUID string.#5468
Merged
common/uuid: fix panic when parsing 32-len invalid UUID string.#5468
Conversation
Member
Member
|
Thanks looks good to me! |
This was referenced Jan 13, 2026
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
his PR fixes a bug in uuid.ParseString where specific malformed UUID strings could cause the application to panic due to an index out of range error.
The problem specifically occurred on string lengths of 32. This is because anything longer than 32 bytes results in a larger initial capacity for the byte slice, which inadvertently prevented the panic (though the logic was still flawed). However, with exactly 32 bytes, the missing bounds check caused a crash when processing the byte groups if the format didn't match expectations.
Updated ParseString to verify slice bounds before accessing text[0] or slicing text[:byteGroup].
Added a unit test in uuid_test.go covering a malformed UUID string (missing the last character) to ensure it returns an error instead of panicking.
panic message on new test with old uuid.go code :