bug: Decoder returns no error on short read

[mixmasala]

What version of fxamacker/cbor are you using?

github.com/fxamacker/cbor/v2 v2.4.0

Does this issue reproduce with the latest release?

yes

What OS and CPU architecture are you using (go env)?

GOARCH="amd64"
GOHOSTOS="linux"

go env Output

$ go env

What did you do?

I'm making a stream transport that chunks data into frames and provides io.Reader and io.Writer interfaces.
the Read() implementation is nonblocking and returns 0, nil if no data is yet buffered, but no end-of-stream protocol message has arrived, so io.EOF is not returned until the remote peer has sent an end-of-stream message.

here is a link to my code and test:
https://github.com/katzenpost/katzenpost/blob/c676eaa9fd1fb5c2db1bd30106b4c97bab79a47c/stream/stream_test.go#L269

What did you expect to see?

I expected decoder.Decode(fooType) to return an error or correctly read data until a fooType was decoded

What did you see instead?

no error was returned and fooType was left uninitialized

[x448]

@mixmasala Nice catch.

Seems like v2.5.0-beta released a few weeks ago includes a fix that maybe fixes this.

#379: Make Decoder.Decode() return io.ErrUnexpectedEOF instead of io.EOF on EOF if current CBOR data item is incomplete.

Can you check if v2.5.0-beta fixes this issue? It's release quality but @fxamacker wants to fuzz it more and update README before release.

[mixmasala]

I tested with 2.5.0-beta but seemingly introduced a regression where the tests that passed before hung. We use github.com/fxamacker/cbor in lots of places so I'm not yet sure what happened.

[fxamacker]

@mixmasala Thanks for the bug report and possible regression for 2.5.0-beta!

I'll look into it this weekend. Any chance you can provide a standalone test or regression test that isn't part of a larger project? 🙏

[fxamacker]

@mixmasala I tracked down the issue and will fix it. Thanks for reporting this!

[fxamacker]

@mixmasala PR #387 should fix this and it adds tests for 100% code coverage of stream.go.

Here is a simplified Go playground example mimicking non-blocking read from stream reader.

BTW, I think Katzenpost's stream.Read() doesn't return io.EOF. Instead, it seems to return a custom error. Given this, CBOR decoder will just return katzenpost's custom error instead of io.ErrUnexpectedEOF when data is truncated because it doesn't receive io.EOF.

Please let me know if PR #387 works for you and resolves the regression in v2.5.0-beta. Thanks again for reporting this!

[x448]

@fxamacker do you want to merge PR #387 and tag version 2.5.0-beta2?