jsonutil.UnmarshalJSON() causes a panic when attempting to unmarshal into a pre-initialized slice with insufficient length

[noamcohen97]

Describe the bug

This issue occurs when unmarshaling might be attempted more than once, such as when a request is retried after a previous unmarshaling failure. I encountered this while calling the GuardDuty GetFinding API.

For instance, the following code triggers a panic:

package main

import (
	"fmt"
	"strings"

	"github.com/aws/aws-sdk-go/private/protocol/json/jsonutil"
	"github.com/aws/aws-sdk-go/service/guardduty"
)

func main() {
	o := guardduty.GetFindingsOutput{}

	err := jsonutil.UnmarshalJSON(&o, strings.NewReader(`{"findings": [{"accountId": -1}]}`))
	if err != nil {
		fmt.Println("Got error, retrying")
	}

	err = jsonutil.UnmarshalJSON(&o, strings.NewReader(`{"findings": [{"accountId": "000000000000"}, {"accountId": "111111111111"}]}`))
	// This point should never be reached, as the code will panic beforehand.​
	if err != nil {
		fmt.Printf("Got Error")
	}

	fmt.Printf("%+v\n", o)
}

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

Either return an error or re-create the slice

Current Behavior

Panic

Reproduction Steps

package main

import (
	"bytes"

	"github.com/aws/aws-sdk-go/private/protocol/json/jsonutil"
)

func main() {
	type input struct {
		ListField []*int64 `locationName:"listField" type:"list"`
	}
	value := input{
		ListField: make([]*int64, 0),
	}
	_ = jsonutil.UnmarshalJSON(&value, bytes.NewReader([]byte(`{"listField": [1]}`)))
}

Possible Solution

Boundary check in jsonutil.unmarshaler.unmarshalList if value.IsNil() == true

Additional Information/Context

panic: reflect: slice index out of range

goroutine 1 [running]:
reflect.Value.Index({0x100b514c0?, 0x1400000c3f0?, 0x14000060098?}, 0x100dba320?)
        <>/go/libexec/src/reflect/value.go:1415 +0x184
github.com/aws/aws-sdk-go/private/protocol/json/jsonutil.unmarshaler.unmarshalList({0x16?}, {0x100b514c0?, 0x1400000c3f0?, 0x4?}, {0x100b52100?, 0x1400000c438?}, {0x1400000eb0a?, 0xffffffffffffffff?})
        <>/go/pkg/mod/github.com/aws/[email protected]/private/protocol/json/jsonutil/unmarshal.go:196 +0x1f8
github.com/aws/aws-sdk-go/private/protocol/json/jsonutil.unmarshaler.unmarshalAny({0x0?}, {0x100b514c0?, 0x1400000c3f0?, 0x8?}, {0x100b52100, 0x1400000c438}, {0x100b54916, 0x33})
        <>/go/pkg/mod/github.com/aws/[email protected]/private/protocol/json/jsonutil/unmarshal.go:115 +0x268
github.com/aws/aws-sdk-go/private/protocol/json/jsonutil.unmarshaler.unmarshalStruct({0x20?}, {0x100b67c20?, 0x1400000c3f0?, 0x4?}, {0x100b61300, 0x14000394ae0?}, {0x100b45193, 0x10})
        <>/go/pkg/mod/github.com/aws/[email protected]/private/protocol/json/jsonutil/unmarshal.go:173 +0x480
github.com/aws/aws-sdk-go/private/protocol/json/jsonutil.unmarshaler.unmarshalAny({0xc0?}, {0x100b67c20?, 0x1400000c3f0?, 0x100dba320?}, {0x100b61300, 0x14000394ae0}, {0x0, 0x0})
        <>/go/pkg/mod/github.com/aws/[email protected]/private/protocol/json/jsonutil/unmarshal.go:113 +0x34c
github.com/aws/aws-sdk-go/private/protocol/json/jsonutil.UnmarshalJSON({0x100b67c20, 0x1400000c3f0}, {0x100b9f058, 0x14000101140})
        <>/go/pkg/mod/github.com/aws/[email protected]/private/protocol/json/jsonutil/unmarshal.go:55 +0x148
main.main()
        panic.go:20 +0xf8

SDK version used

v1.55.5

Environment details (Version of Go (go version)? OS name and version, etc.)

go version go1.23.2 darwin/arm64

[lucix-aws]

#5270

[github-actions]

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.