From 5c60a4fb0a7f49105e2daa10efe45faf2bf3a36b Mon Sep 17 00:00:00 2001 From: Didier Spezia Date: Wed, 27 May 2015 11:44:19 +0000 Subject: text/template: fix variadic function call corner case Executing a template involving variadic functions featuring a []interface{} slice (such as printf) could result in a panic in reflect.Value.Call, due to incorrect type checking. The following expressions failed (with a panic): {{true|printf}} {{1|printf}} {{1.1|printf}} {{'x'|printf}} {{1+2i|printf}} Implemented proper type checks for the fixed parameters of the variadic functions. Fixes #10946 Change-Id: Ia75333f651f73b3d2e024cb0c47cc30d90cb6852 Reviewed-on: https://go-review.googlesource.com/10403 Reviewed-by: Rob Pike --- src/text/template/exec.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'src/text/template/exec.go') diff --git a/src/text/template/exec.go b/src/text/template/exec.go index b4e6cc8282..8e9edcfbe9 100644 --- a/src/text/template/exec.go +++ b/src/text/template/exec.go @@ -581,7 +581,15 @@ func (s *state) evalCall(dot, fun reflect.Value, node parse.Node, name string, a if final.IsValid() { t := typ.In(typ.NumIn() - 1) if typ.IsVariadic() { - t = t.Elem() + if numIn-1 < numFixed { + // The added final argument corresponds to a fixed parameter of the function. + // Validate against the type of the actual parameter. + t = typ.In(numIn - 1) + } else { + // The added final argument corresponds to the variadic part. + // Validate against the type of the elements of the variadic slice. + t = t.Elem() + } } argv[i] = s.validateType(final, t) } -- cgit v1.3