Skip to content

fix: reset skipped-nodes stack on getValue entry to prevent slice overflow panic [#4818] - #4819

Open
waterWang wants to merge 2 commits into
gin-gonic:masterfrom
waterWang:fix/skippednodes-overflow
Open

fix: reset skipped-nodes stack on getValue entry to prevent slice overflow panic [#4818]#4819
waterWang wants to merge 2 commits into
gin-gonic:masterfrom
waterWang:fix/skippednodes-overflow

Conversation

@waterWang

Copy link
Copy Markdown

Fixes #4818

Root cause

With HandleMethodNotAllowed = true, handleHTTPRequest calls getValue
once per method tree in the HandleMethodNotAllowed loop, reusing the
same c.skippedNodes stack from the pooled Context. getValue pushes
entries onto the stack via a raw reslice ([:index+1]) that cannot grow
past engine.maxSections. Without resetting the stack on entry, residue
from a previous tree accumulates until the next reslice exceeds capacity
and panics with "slice bounds out of range".

Fix

Reset *skippedNodes = (*skippedNodes)[:0] at the top of getValue so
every call starts with an empty stack. This is the single point that
covers all callers, including the HandleMethodNotAllowed loop.

Tests

  • TestIssue4818_skippedNodesOverflow_Panic: original repro from the
    issue — POST to a route that causes skippedNodes residue to exceed
    maxSections capacity. Confirms no panic and 404 (correct).
  • TestIssue4818_MethodNotAllowedStillWorks: PATCH a path that only
    has a GET route, confirming the HandleMethodNotAllowed loop still
    produces a correct 405 with Allow header.
  • TestIssue4818_MethodNotAllowedManyTrees: stress test with 9 method
    trees targeting a single GET-only path, verifying no overflow.

@codecov

codecov Bot commented Aug 27, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.32%. Comparing base (3dc1cd6) to head (b261e00).
⚠️ Report is 292 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4819      +/-   ##
==========================================
- Coverage   99.21%   98.32%   -0.89%     
==========================================
  Files          42       48       +6     
  Lines        3182     3173       -9     
==========================================
- Hits         3157     3120      -37     
- Misses         17       43      +26     
- Partials        8       10       +2     
Flag Coverage Δ
?
--ldflags="-checklinkname=0" -tags sonic 98.31% <100.00%> (?)
-tags go_json 98.25% <100.00%> (?)
-tags nomsgpack 98.30% <100.00%> (?)
go-1.18 ?
go-1.19 ?
go-1.20 ?
go-1.21 ?
go-1.25 98.32% <100.00%> (?)
go-1.26 98.32% <100.00%> (?)
macos-latest 98.32% <100.00%> (-0.89%) ⬇️
ubuntu-latest 98.32% <100.00%> (-0.89%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Panic: slice bounds out of range in getValue with HandleMethodNotAllowed enabled

1 participant