oapi-codegen was crashed: panic: runtime error: slice bounds out of range

[tokers]

Hi there,

Background

I'm using oapi-codegen to generate Go types for the schemas written in yaml. But when I tried to generate one of the files, oapi-codegen crashed. I just got some error messages like:

panic: runtime error: slice bounds out of range [25:17]

goroutine 1 [running]:
github.com/getkin/kin-openapi/openapi3.(*Loader).getResolvedRefPath(0xc00015eab0, {0xc000126db0?, 0xc000120ac8?}, 0xc000120ac8, 0xc00015ebd0, 0xc00015f950)
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:809 +0x185
github.com/getkin/kin-openapi/openapi3.(*Loader).resolveSchemaRef(0xc00015eab0, 0xc0001bb8c0?, 0xc000120a08, 0xc00015ebd0, {0xc000167278, 0x0, 0x0})
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:745 +0x92f
github.com/getkin/kin-openapi/openapi3.(*Loader).resolveSchemaRef(0xc00015eab0, 0x1?, 0xc0001207b0, 0xc00015ebd0, {0xc000167278, 0x0, 0x0})
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:761 +0x3c5
github.com/getkin/kin-openapi/openapi3.(*Loader).ResolveRefsIn(0xc00015eab0, 0xc00019c2a0, 0x200?)
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:208 +0x4a7
github.com/getkin/kin-openapi/openapi3.(*Loader).loadFromDataWithPathInternal(0xc00015eab0, {0xc000210000, 0x114, 0x200}, 0xc00015ebd0)
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:168 +0x16e
github.com/getkin/kin-openapi/openapi3.(*Loader).loadFromURIInternal(0x7fff28da1362?, 0x0?)
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:85 +0x54
github.com/getkin/kin-openapi/openapi3.(*Loader).LoadFromURI(...)
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:71
github.com/getkin/kin-openapi/openapi3.(*Loader).LoadFromFile(0xc00015eab0, {0x7fff28da1362, 0x2c})
        /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:77 +0xc5
github.com/deepmap/oapi-codegen/pkg/util.LoadSwagger({0x7fff28da1362, 0x2c})
        /home/alex/go/pkg/mod/github.com/deepmap/oapi-codegen@v1.12.2/pkg/util/loader.go:18 +0xf0
main.main()
        /home/alex/go/pkg/mod/github.com/deepmap/oapi-codegen@v1.12.2/cmd/oapi-codegen/oapi-codegen.go:256 +0x13a5

How to reproduce it?

You can reproduce this problem by using the following directories and files.

$ tree
.
└── api
    └── v1alpha1
        ├── core
        │   └── base.yaml
        └── http
            └── plugins
                └── rate-limiting.yaml

5 directories, 2 files

Contents of api/v1alpha1/core/base.yaml:

components:
  schemas:
    name:
      type: string
      pattern: "[a-z0-9]([-a-z0-9]*[a-z0-9])?"

Contents of api/v1alpha1/http/plugins/rate-limiting.yaml:

components:
  schemas:
    rate-limiting:
      type: object
      properties:
        name:
          $ref: ../../core/base.yaml#/components/schemas/name
        count:
          type: integer
          minimum: 0
        period:
          type: integer
          minimum: 1

Then execute the command below:

oapi-codegen --package=plugins --generate types,skip-prune --old-config-style --import-mapping=../../core/base.yaml:github.com/myorg/myrepo/api/v1alpha1/core api/v1alpha1/http/plugins/rate-limiting.yaml

Environments

• OS: Linux fedora 5.17.12-100.fc34.x86_64 #1 SMP PREEMPT Mon May 30 17:47:02 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
• Version of oapi-codegen: v1.12.2

My Troubleshooting

I tried to use dlv to check out whether oapi-codegen will panic, and the panic line of code is:

 dlv exec `which oapi-codegen` -- --package=plugins --generate types,skip-prune --old-config-style --import-mapping=../../core/base.yaml:github.com/myorg/myrepo/api/v1alpha1/core api/v1alpha1/http/plugins/rate-limiting.yaml
Type 'help' for list of commands.
(dlv) c
> [unrecovered-panic] runtime.fatalpanic() /usr/local/go/src/runtime/panic.go:1065 (hits goroutine(1):1 total:1) (PC: 0x4359c0)
Warning: debugging optimized function
        runtime.curg._panic.arg: interface {}(string) "runtime error: slice bounds out of range [25:17]"
  1060: // fatalpanic implements an unrecoverable panic. It is like fatalthrow, except
  1061: // that if msgs != nil, fatalpanic also prints panic messages and decrements
  1062: // runningPanicDefers once main is blocked from exiting.
  1063: //
  1064: //go:nosplit
=>1065: func fatalpanic(msgs *_panic) {
  1066:         pc := getcallerpc()
  1067:         sp := getcallersp()
  1068:         gp := getg()
  1069:         var docrash bool
  1070:         // Switch to the system stack to avoid any stack growth, which
(dlv) frame 3
> [unrecovered-panic] runtime.fatalpanic() /usr/local/go/src/runtime/panic.go:1065 (hits goroutine(1):1 total:1) (PC: 0x4359c0)
Warning: debugging optimized function
Frame 3: /home/alex/go/pkg/mod/github.com/getkin/kin-openapi@v0.107.0/openapi3/loader.go:809 (PC: 7661a5)
   804:         // ref. to external file
   805:         if resolved.Ref != "" {
   806:                 return resolved.Ref
   807:         }
   808:         // found dest spec. file
=> 809:         return path.Dir(found.Path)[len(loader.rootDir):]
   810: }
   811:
   812: func (loader *Loader) resolveSecuritySchemeRef(doc *T, component *SecuritySchemeRef, documentPath *url.URL) (err error) {
   813:         if component != nil && component.Value != nil {
   814:                 if loader.visitedSecurityScheme == nil {
(dlv) p found.Path
"api/v1alpha1/core/base.yaml"
(dlv) p loader.rootDir
"api/v1alpha1/http/plugins"
(dlv)

I'm not familiar with the design of oapi-codegen, but it looks like the way to calculate the path of referenced documents is not correct.

By the way, If just enter the dir api/v1alpha1/http/plugins, then everything works like a charm.

$ cd api/v1alpha1/http/plugins
$ oapi-codegen --package=plugins --generate types,skip-prune --old-config-style --import-mapping=../../core/base.yaml:github.com/myorg/myrepo/api/v1alpha1/core rate-limiting.yaml
// Package plugins provides primitives to interact with the openapi HTTP API.
//
// Code generated by github.com/deepmap/oapi-codegen version v1.12.2 DO NOT EDIT.
package plugins

import (
        externalRef0 "github.com/myorg/myrepo/api/v1alpha1/core"
)

// RateLimiting defines model for rate-limiting.
type RateLimiting struct {
        Count  *int               `json:"count,omitempty"`
        Name   *externalRef0.Name `json:"name,omitempty"`
        Period *int               `json:"period,omitempty"`
}

[deepmap-marcinr]

Oh, that's kin-openapi crashing when loading the spec. It's before it even gets to our code.

[tokers]

OK, I'll try to report this problem to kin-openapi.

[jamietanna]

Upstream issue: getkin/kin-openapi#652