text/template: panic: Call using zero Value argument

[bep]

This was discovered running go-fuzz on Hugo's template handling.

OS: Linux
Go version: 1.4.2

The following program panics:

package main

import (
    "html/template"
    "io/ioutil"
)

func main() {
    t, err := template.New("foo").Funcs(funcs).Parse(data)
    if err != nil {
        return
    }
    t.Execute(ioutil.Discard, "foo")
}

var data = "{{ A 433937734937734969526500969526500 }}"

var funcs = map[string]interface{}{
    "A": func1,
}

func func1(args ...interface{}) int {
    return len(args)
}

oroutine 1 [running]:
text/template.errRecover(0xc20802ff08)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:104 +0x14f
reflect.Value.call(0x526d20, 0x5d64e0, 0x13, 0x578bf0, 0x4, 0xc2080200a0, 0x1, 0x1, 0x0, 0x0, ...)
    /home/bep/.gvm/gos/go1.4.2/src/reflect/value.go:360 +0x491
reflect.Value.Call(0x526d20, 0x5d64e0, 0x13, 0xc2080200a0, 0x1, 0x1, 0x0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/reflect/value.go:296 +0xbc
text/template.(*state).evalCall(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0x526d20, 0x5d64e0, 0x13, 0x7f9c2b8fabe8, 0xc20803c6f0, 0x5c3933, ...)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:567 +0xaa4
text/template.(*state).evalFunction(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0xc20803c720, 0x7f9c2b8fabe8, 0xc20803c6f0, 0xc208020080, 0x2, 0x2, ...)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:459 +0x33b
text/template.(*state).evalCommand(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0xc20803c6f0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:359 +0x210
text/template.(*state).evalPipeline(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0xc2080340a0, 0x0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:332 +0x1a8
text/template.(*state).walk(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0x7f9c2b8fab10, 0xc20803c7e0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:167 +0x145
text/template.(*state).walk(0xc2080721c0, 0x511a20, 0xc20800a2d0, 0x58, 0x7f9c2b8fab58, 0xc20803c6c0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:175 +0x862
text/template.(*Template).Execute(0xc208072040, 0x7f9c2b8fa918, 0xc20800a1e0, 0x511a20, 0xc20800a2d0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/exec.go:155 +0x3f2
html/template.(*Template).Execute(0xc20803c5d0, 0x7f9c2b8fa918, 0xc20800a1e0, 0x511a20, 0xc20800a2d0, 0x0, 0x0)
    /home/bep/.gvm/gos/go1.4.2/src/html/template/template.go:78 +0xa3
main.main()
    /home/bep/dev/go/src/testmain/main.go:13 +0x119

goroutine 5 [runnable]:
text/template/parse.lexText(0xc20807a000, 0x5d68f8)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/parse/lex.go:228 +0x37b
text/template/parse.(*lexer).run(0xc20807a000)
    /home/bep/.gvm/gos/go1.4.2/src/text/template/parse/lex.go:198 +0x5d
created by text/template/parse.lex
    /home/bep/.gvm/gos/go1.4.2/src/text/template/parse/lex.go:191 +0x1ac
Error: process exited with code 2.

[bep]

/cc @dvyukov I didn't see this case in your set of issues. But I may be wrong.

[dvyukov]

I did not spot this case.
The case fails the same way on tip.

[dvyukov]

Added this to https://github.com/dvyukov/go-fuzz/blob/master/README.md list.

[robpike]

This is a problem in text/template, not html/template.

[dspezia]

Fixed by https://go-review.googlesource.com/#/c/9651/ ?