github.com/gomarkdown/markdown: Out-of-bounds Read in SmartypantsRenderer

#!/usr/bin/env python3
"""
verify_cve_2026_40890.py

Checks local source trees for the gomarkdown Smartypants fix for CVE-2026-40890.
It does NOT resolve all Go module graphs; it inspects source present in a repo,
vendor tree, or unpacked module cache beneath the supplied path.

Exit codes:
  0 = PATCHED
  1 = VULNERABLE
  2 = UNKNOWN / not found / insufficient evidence
"""

import os
import re
import sys
from pathlib import Path

TARGET_REL = os.path.join("github.com", "gomarkdown", "markdown", "html", "smartypants.go")
FUNC_HINT = "func (r *SPRenderer) smartLeftAngle"
FIX_GUARD = "if i == len(text)"
OLD_WRITE = "out.Write(text[:i+1])"


def read_text(path: Path):
    try:
        return path.read_text(encoding="utf-8", errors="ignore")
    except Exception:
        return None


def classify_file(path: Path):
    text = read_text(path)
    if text is None:
        return None, f"unable to read {path}"

    if FUNC_HINT not in text:
        return None, f"target function not found in {path}"

    has_fix = FIX_GUARD in text
    # Vulnerable pattern: old write exists and fixed guard does not.
    has_old_pattern = OLD_WRITE in text and not has_fix

    if has_fix:
        return "PATCHED", f"fixed guard present in {path}"
    if has_old_pattern:
        return "VULNERABLE", f"old slice/write pattern present without guard in {path}"

    # Fallback: extract the function body and look for guard heuristically.
    m = re.search(r"func \(r \*SPRenderer\) smartLeftAngle\([^\)]*\) int \{(.*?)\n\}", text, re.S)
    if m:
        body = m.group(1)
        if "len(text)" in body and "return i" in body:
            return "PATCHED", f"heuristic indicates patched smartLeftAngle in {path}"
        if OLD_WRITE in body:
            return "VULNERABLE", f"heuristic indicates vulnerable smartLeftAngle in {path}"

    return None, f"could not confidently classify {path}"


def discover_candidates(root: Path):
    candidates = []

    # Exact vendor/module paths first.
    for p in root.rglob("smartypants.go"):
        parts = str(p).replace("\\", "/")
        if TARGET_REL.replace("\\", "/") in parts:
            candidates.append(p)
            continue
        # Common Go module cache naming: .../gomarkdown/markdown@version/html/smartypants.go
        if re.search(r"gomarkdown[/\\]markdown(@[^/\\]+)?[/\\]html[/\\]smartypants\.go$", str(p)):
            candidates.append(p)

    # De-duplicate while preserving order.
    seen = set()
    uniq = []
    for c in candidates:
        s = str(c.resolve())
        if s not in seen:
            seen.add(s)
            uniq.append(c)
    return uniq


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_cve_2026_40890.py /path/to/repo_or_modules")
        sys.exit(2)

    root = Path(sys.argv[1]).resolve()
    if not root.exists():
        print(f"UNKNOWN - path does not exist: {root}")
        sys.exit(2)

    candidates = discover_candidates(root)
    if not candidates:
        print("UNKNOWN - no local gomarkdown smartypants.go file found under supplied path")
        sys.exit(2)

    patched = []
    vulnerable = []
    unknown = []

    for candidate in candidates:
        status, reason = classify_file(candidate)
        if status == "PATCHED":
            patched.append(reason)
        elif status == "VULNERABLE":
            vulnerable.append(reason)
        else:
            unknown.append(reason)

    # If any vulnerable copy exists in the supplied tree, fail closed.
    if vulnerable:
        print("VULNERABLE")
        for line in vulnerable:
            print(f"- {line}")
        if patched:
            for line in patched:
                print(f"- also found patched copy: {line}")
        sys.exit(1)

    if patched:
        print("PATCHED")
        for line in patched:
            print(f"- {line}")
        sys.exit(0)

    print("UNKNOWN")
    for line in unknown:
        print(f"- {line}")
    sys.exit(2)


if __name__ == "__main__":
    main()