From a2956bbb2bea8cbe132ce73668f947ab6e30e15a Mon Sep 17 00:00:00 2001 From: Yanhu007 Date: Wed, 15 Apr 2026 09:36:15 +0800 Subject: [PATCH] fix: prevent slice bounds panic in Row.matchAll Row.matchAll could panic with "slice bounds out of range" when matching against certain malformed glob patterns like "/{a{*.json{". The computed end index (idx + next + 1) could exceed the string length. Add explicit bounds checks: return false early if the string has fewer runes than needed or if the computed slice end exceeds the string length. Fixes #59 --- match/row.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/match/row.go b/match/row.go index 4379042..7e921b7 100644 --- a/match/row.go +++ b/match/row.go @@ -31,11 +31,20 @@ func (self Row) matchAll(s string) bool { } } - if i < length || !m.Match(s[idx:idx+next+1]) { + if i < length { return false } - idx += next + 1 + end := idx + next + 1 + if end > len(s) { + return false + } + + if !m.Match(s[idx:end]) { + return false + } + + idx = end } return true