encoding/xml: check type when unmarshaling innerxml field

We only support unmarshaling into a string or a []byte, but we
previously would try (and panic while) setting a slice of a different
type. The docs say ",innerxml" is ignored if the type is not string or
[]byte, so do that for other slices as well.

Fixes #15600.

Change-Id: Ia64815945a14c3d04a0a45ccf413e38b58a69416
Reviewed-on: https://go-review.googlesource.com/32919
Run-TryBot: Quentin Smith <quentin@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>

2 files changed, 22 insertions, 1 deletions

diff --git a/src/encoding/xml/read.go b/src/encoding/xml/read.go
index ba62366560..ed4470f3eb 100644
--- a/src/encoding/xml/read.go
+++ b/src/encoding/xml/read.go
@@ -582,7 +582,9 @@ Loop:
 	case reflect.String:
 		t.SetString(string(saveXMLData))
 	case reflect.Slice:
-		t.Set(reflect.ValueOf(saveXMLData))
+		if t.Type().Elem().Kind() == reflect.Uint8 {
+			t.Set(reflect.ValueOf(saveXMLData))
+		}
 	}
 
 	return nil
diff --git a/src/encoding/xml/read_test.go b/src/encoding/xml/read_test.go
index 7a98092803..b53d72c716 100644
--- a/src/encoding/xml/read_test.go
+++ b/src/encoding/xml/read_test.go
@@ -733,3 +733,22 @@ func TestMalformedComment(t *testing.T) {
 		}
 	}
 }
+
+type IXField struct {
+	Five        int      `xml:"five"`
+	NotInnerXML []string `xml:",innerxml"`
+}
+
+// Issue 15600. ",innerxml" on a field that can't hold it.
+func TestInvalidInnerXMLType(t *testing.T) {
+	v := new(IXField)
+	if err := Unmarshal([]byte(`<tag><five>5</five><innertag/></tag>`), v); err != nil {
+		t.Errorf("Unmarshal failed: got %v", err)
+	}
+	if v.Five != 5 {
+		t.Errorf("Five = %v, want 5", v.Five)
+	}
+	if v.NotInnerXML != nil {
+		t.Errorf("NotInnerXML = %v, want nil", v.NotInnerXML)
+	}
+}