diff --git a/parser/src/scanner.rs b/parser/src/scanner.rs index e97361e..606be85 100644 --- a/parser/src/scanner.rs +++ b/parser/src/scanner.rs @@ -2386,7 +2386,8 @@ impl Scanner { fn fetch_value(&mut self) -> ScanResult { let sk = self.simple_keys.last().unwrap().clone(); let start_mark = self.mark; - let is_implicit_flow_mapping = self.flow_level > 0 && !self.flow_mapping_started; + let is_implicit_flow_mapping = + !self.implicit_flow_mapping_states.is_empty() && !self.flow_mapping_started; if is_implicit_flow_mapping { *self.implicit_flow_mapping_states.last_mut().unwrap() = ImplicitMappingState::Inside; } diff --git a/parser/tests/fuzz.rs b/parser/tests/fuzz.rs index 3076c8c..7e49b21 100644 --- a/parser/tests/fuzz.rs +++ b/parser/tests/fuzz.rs @@ -40,3 +40,18 @@ fn fuzz_1() { let s = str::from_utf8(raw_input).unwrap(); let _ = run_parser(s); } + +#[test] +fn fuzz_2() { + // Crashing with an unwrap of a None value. + // There is an imbalance of implicit flow mapping contexts here between the opening `[`/`{` and + // closing `]`/`}`. We would test against flow-level when only `[` can create implicit flow + // mappings. + let raw_input: &[u8] = &[ + 91, 91, 32, 101, 58, 9, 123, 63, 32, 45, 106, 101, 58, 9, 123, 63, 32, 44, 117, 101, 58, 9, + 123, 63, 32, 44, 9, 26, 58, 32, 126, 93, 8, 58, 32, 58, 10, 29, 58, 58, 58, 32, 58, 29, 63, + 32, 44, 9, 26, 58, 32, 126, 93, 8, 58, 32, 58, 10, 78, 32, + ]; + let s = str::from_utf8(raw_input).unwrap(); + let _ = run_parser(s); +}