encoding/json: fix Unmarshal hang on recursive pointers

indirect walks down v until it gets to a non-pointer. But it does not
handle the case when v is a pointer to itself, like in:

	var v interface{}
	v = &v
	Unmarshal(b, v)

So just stop immediately if we see v is a pointer to itself.

Fixes #31740

Change-Id: Ie396264119e24d70284cd9bf76dcb2050babb069
Reviewed-on: https://go-review.googlesource.com/c/go/+/174337
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Daniel Martí <mvdan@mvdan.cc>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

2 files changed, 20 insertions, 0 deletions

diff --git a/src/encoding/json/decode.go b/src/encoding/json/decode.go
index 3ca3d7803e..bdd94e34ce 100644
--- a/src/encoding/json/decode.go
+++ b/src/encoding/json/decode.go
@@ -535,6 +535,14 @@ func indirect(v reflect.Value, decodingNull bool) (Unmarshaler, encoding.TextUnm
 		if v.Elem().Kind() != reflect.Ptr && decodingNull && v.CanSet() {
 			break
 		}
+
+		// Prevent infinite loop if v is an interface pointing to its own address:
+		//     var v interface{}
+		//     v = &v
+		if v.Elem().Kind() == reflect.Interface && v.Elem().Elem() == v {
+			v = v.Elem()
+			break
+		}
 		if v.IsNil() {
 			v.Set(reflect.New(v.Type().Elem()))
 		}
diff --git a/src/encoding/json/decode_test.go b/src/encoding/json/decode_test.go
index 8da74fa3d3..719a9fa290 100644
--- a/src/encoding/json/decode_test.go
+++ b/src/encoding/json/decode_test.go
@@ -2334,3 +2334,15 @@ func TestUnmarshalPanic(t *testing.T) {
 	Unmarshal([]byte("{}"), &unmarshalPanic{})
 	t.Fatalf("Unmarshal should have panicked")
 }
+
+// The decoder used to hang if decoding into an interface pointing to its own address.
+// See golang.org/issues/31740.
+func TestUnmarshalRecursivePointer(t *testing.T) {
+	var v interface{}
+	v = &v
+	data := []byte(`{"a": "b"}`)
+
+	if err := Unmarshal(data, v); err != nil {
+		t.Fatal(err)
+	}
+}