panic / memory corruption when decoding msgpack struct with embedded maps

[philipatl]

Please see my example below. The issue occurs when you have a certain nesting of structs with maps. In this case, we have a struct with a map of string to slice of pointer to struct with a map of string to slice of string. This appears to cause the kMap decode function, which is called recursively, to assign memory where it should not.

package main

import (
	"bytes"
	"fmt"

	"github.com/ugorji/go/codec"
)

type Inner struct {
	InnerMap map[string][]string
}

type Outer struct {
	OuterMap map[string][]*Inner
}

func reproPanic() {
	inner := &Inner{}
	inner.InnerMap = map[string][]string{
		"foo": {
			"bar",
		},
	}

	outer := &Outer{}
	outer.OuterMap = make(map[string][]*Inner)
	outer.OuterMap["blah"] = []*Inner{
		inner,
	}

	outer2 := &Outer{}

	encodeDecodeEncodeRoundtrip(outer, outer2)

	// not expected to get here
	fmt.Printf("NOT REACHED!?")
}

func encodeDecodeEncodeRoundtrip(obj, dest interface{}) {

	handle := &codec.MsgpackHandle{}
	encoder := codec.NewEncoder(nil, handle)
	decoder := codec.NewDecoder(nil, handle)

	buf := bytes.NewBuffer(nil)
	encoder.Reset(buf)
	encoder.MustEncode(obj)

	decoder.Reset(bytes.NewBuffer(buf.Bytes()))
	decoder.MustDecode(dest)

	buf = bytes.NewBuffer(nil)
	encoder.Reset(buf)
	encoder.MustEncode(dest)
}

func main() {
	reproPanic()
}