Improper Input Validation in GoGo Protobuf

[pratikdhanave-searce]

Hi team @gpaul @gburt @gaffneyc @AlekSi @temoto
thank you for developing awesome Protocol Buffers for Go with Gadgets

I am using github.com/gogo/protobuf@1.3.2 for my project.
I am seeing security waring as following by github Dependabot alerts

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

can you guide me how to work on this security issue so that I can fix and create pull request ?

Thank you

[temoto]

@pratikdhanavesearce not a maintainer in this project, just added a simple tool guided patch. Dependabot says you are using version before 1.3.2. So you should upgrade to 1.3.2.

go get github.com/gogo/protobuf@1.3.2
# or
go get github.com/gogo/protobuf@latest

https://go.dev/doc/modules/managing-dependencies#getting_version