fix: prevent segmentation violation on empty yaml in multidoc

Fixes: https://github.com/helm/helm/issues/31544

Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
(cherry picked from commit 81d244ca21)

internal/chart/v3/lint/rules/crds.go

@@ -80,8 +80,10 @@ func Crds(linter *support.Linter) {
 				return
 			}
 
-			linter.RunLinterRule(support.ErrorSev, fpath, validateCrdAPIVersion(yamlStruct))
-			linter.RunLinterRule(support.ErrorSev, fpath, validateCrdKind(yamlStruct))
+			if yamlStruct != nil {
+				linter.RunLinterRule(support.ErrorSev, fpath, validateCrdAPIVersion(yamlStruct))
+				linter.RunLinterRule(support.ErrorSev, fpath, validateCrdKind(yamlStruct))
+			}
 		}
 	}
 }

internal/chart/v3/lint/rules/crds_test.go

@@ -17,6 +17,8 @@ limitations under the License.
 package rules
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -34,3 +36,31 @@ func TestInvalidCrdsDir(t *testing.T) {
 	assert.Len(t, res, 1)
 	assert.ErrorContains(t, res[0].Err, "not a directory")
 }
+
+// multi-document YAML with empty documents would panic
+func TestCrdWithEmptyDocument(t *testing.T) {
+	chartDir := t.TempDir()
+
+	os.WriteFile(filepath.Join(chartDir, "Chart.yaml"), []byte(
+		`apiVersion: v1
+name: test
+version: 0.1.0
+`), 0644)
+
+	// CRD with comments before --- (creates empty document)
+	crdsDir := filepath.Join(chartDir, "crds")
+	os.Mkdir(crdsDir, 0755)
+	os.WriteFile(filepath.Join(crdsDir, "test.yaml"), []byte(
+		`# Comments create empty document
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: test.example.io
+`), 0644)
+
+	linter := support.Linter{ChartDir: chartDir}
+	Crds(&linter)
+
+	assert.Len(t, linter.Messages, 0)
+}

pkg/chart/v2/lint/rules/crds.go

@@ -80,8 +80,10 @@ func Crds(linter *support.Linter) {
 				return
 			}
 
-			linter.RunLinterRule(support.ErrorSev, fpath, validateCrdAPIVersion(yamlStruct))
-			linter.RunLinterRule(support.ErrorSev, fpath, validateCrdKind(yamlStruct))
+			if yamlStruct != nil {
+				linter.RunLinterRule(support.ErrorSev, fpath, validateCrdAPIVersion(yamlStruct))
+				linter.RunLinterRule(support.ErrorSev, fpath, validateCrdKind(yamlStruct))
+			}
 		}
 	}
 }

pkg/chart/v2/lint/rules/crds_test.go

@@ -17,6 +17,8 @@ limitations under the License.
 package rules
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -34,3 +36,31 @@ func TestInvalidCrdsDir(t *testing.T) {
 	assert.Len(t, res, 1)
 	assert.ErrorContains(t, res[0].Err, "not a directory")
 }
+
+// multi-document YAML with empty documents would panic
+func TestCrdWithEmptyDocument(t *testing.T) {
+	chartDir := t.TempDir()
+
+	os.WriteFile(filepath.Join(chartDir, "Chart.yaml"), []byte(
+		`apiVersion: v1
+name: test
+version: 0.1.0
+`), 0644)
+
+	// CRD with comments before --- (creates empty document)
+	crdsDir := filepath.Join(chartDir, "crds")
+	os.Mkdir(crdsDir, 0755)
+	os.WriteFile(filepath.Join(crdsDir, "test.yaml"), []byte(
+		`# Comments create empty document
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: test.example.io
+`), 0644)
+
+	linter := support.Linter{ChartDir: chartDir}
+	Crds(&linter)
+
+	assert.Len(t, linter.Messages, 0)
+}