Merge pull request #85 from brackendawson/panic

Fix several panics in ParseCalendar

calendar_fuzz_test.go

@@ -0,0 +1,22 @@
+//go:build go1.18
+// +build go1.18
+
+package ics
+
+import (
+	"bytes"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func FuzzParseCalendar(f *testing.F) {
+	ics, err := os.ReadFile("testdata/timeparsing.ics")
+	require.NoError(f, err)
+	f.Add(ics)
+	f.Fuzz(func(t *testing.T, ics []byte) {
+		_, err := ParseCalendar(bytes.NewReader(ics))
+		t.Log(err)
+	})
+}

property.go

@@ -2,6 +2,7 @@ package ics
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -194,6 +195,9 @@ func parsePropertyParam(r *BaseProperty, contentLine string, p int) (*BaseProper
 	k, v := "", ""
 	k = string(contentLine[p : p+tokenPos[1]])
 	p += tokenPos[1]
+	if p >= len(contentLine) {
+		return nil, p, fmt.Errorf("missing property param operator for %s in %s", k, r.IANAToken)
+	}
 	switch rune(contentLine[p]) {
 	case '=':
 		p += 1
@@ -210,6 +214,9 @@ func parsePropertyParam(r *BaseProperty, contentLine string, p int) (*BaseProper
 			return nil, 0, fmt.Errorf("parse error: %w %s in %s", err, k, r.IANAToken)
 		}
 		r.ICalParameters[k] = append(r.ICalParameters[k], v)
+		if p >= len(contentLine) {
+			return nil, p, fmt.Errorf("unexpected end of property %s", r.IANAToken)
+		}
 		switch rune(contentLine[p]) {
 		case ',':
 			p += 1
@@ -258,6 +265,9 @@ func parsePropertyParamValue(s string, p int) (string, int, error) {
 			0x1C, 0x1D, 0x1E, 0x1F:
 			return "", 0, fmt.Errorf("unexpected char ascii:%d in property param value", s[p])
 		case '\\':
+			if p+2 >= len(s) {
+				return "", 0, errors.New("unexpected end of param value")
+			}
 			r = append(r, []byte(FromText(string(s[p+1:p+2])))...)
 			p++
 			continue

testdata/fuzz/FuzzParseCalendar/5940bf4f62ecac30

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("0;0=\\")

testdata/fuzz/FuzzParseCalendar/5f69bd55acfce1af

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("0;0")

testdata/fuzz/FuzzParseCalendar/8856e23652c60ed6

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("0;0=0")