From d3eacc0bab779d6cf98221f5268828fff287876e Mon Sep 17 00:00:00 2001
From: David Barroso <dbarrosop@dravetech.com>
Date: Wed, 18 Mar 2026 07:37:54 +0100
Subject: [PATCH] fix: prevent panic on negative slice index in Delete with
 malformed JSON (GO-2026-4514)

---
 parser.go      | 10 +++++++---
 parser_test.go | 18 ++++++++++++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/parser.go b/parser.go
index 76ec02d..1a4e337 100644
--- a/parser.go
+++ b/parser.go
@@ -731,7 +731,7 @@ func Delete(data []byte, keys ...string) []byte {
 	if !array {
 		if len(keys) > 1 {
 			_, _, startOffset, endOffset, err = internalGet(data, keys[:lk-1]...)
-			if err == KeyPathNotFoundError {
+			if err != nil {
 				// problem parsing the data
 				return data
 			}
@@ -743,7 +743,11 @@ func Delete(data []byte, keys ...string) []byte {
 			return data
 		}
 		keyOffset += startOffset
-		_, _, _, subEndOffset, _ := internalGet(data[startOffset:endOffset], keys[lk-1])
+		var subEndOffset int
+		_, _, _, subEndOffset, err = internalGet(data[startOffset:endOffset], keys[lk-1])
+		if err != nil {
+			return data
+		}
 		endOffset = startOffset + subEndOffset
 		tokEnd := tokenEnd(data[endOffset:])
 		tokStart := findTokenStart(data[:keyOffset], ","[0])
@@ -757,7 +761,7 @@ func Delete(data []byte, keys ...string) []byte {
 		}
 	} else {
 		_, _, keyOffset, endOffset, err = internalGet(data, keys...)
-		if err == KeyPathNotFoundError {
+		if err != nil {
 			// problem parsing the data
 			return data
 		}
diff --git a/parser_test.go b/parser_test.go
index 7036feb..7e90493 100644
--- a/parser_test.go
+++ b/parser_test.go
@@ -227,6 +227,24 @@ var deleteTests = []DeleteTest{
 		path: []string{"test"},
 		data: `   {}`,
 	},
+	{
+		desc: "GO-2026-4514: malformed JSON without enclosing braces should not panic",
+		json: `"0":"0":`,
+		path: []string{"0"},
+		data: `"0":"0":`,
+	},
+	{
+		desc: "GO-2026-4514: malformed JSON with key but truncated value should not panic",
+		json: `{"a":  `,
+		path: []string{"a"},
+		data: `{"a":  `,
+	},
+	{
+		desc: "GO-2026-4514: malformed nested JSON with truncated value should not panic",
+		json: `{"a":{"b":  `,
+		path: []string{"a", "b"},
+		data: `{"a":{"b":  `,
+	},
 }
 
 var setTests = []SetTest{