internal/format: validate stanza fields when marshaling

Reported by Joe Doyle of Trail of Bits.

internal/format/format.go

@@ -109,6 +109,14 @@ var stanzaPrefix = []byte("->")
 var footerPrefix = []byte("---")
 
 func (r *Stanza) Marshal(w io.Writer) error {
+	if !isValidString(r.Type) {
+		return fmt.Errorf("invalid stanza type: %q", r.Type)
+	}
+	for _, a := range r.Args {
+		if !isValidString(a) {
+			return fmt.Errorf("invalid stanza argument: %q", a)
+		}
+	}
 	if _, err := w.Write(stanzaPrefix); err != nil {
 		return err
 	}

internal/format/format_test.go

@@ -44,6 +44,22 @@ func TestStanzaMarshal(t *testing.T) {
 	if exp := "-> test 1 2 3\nQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB\n\n"; buf.String() != exp {
 		t.Errorf("wrong 64 columns stanza encoding: expected %q, got %q", exp, buf.String())
 	}
+
+	for _, s := range []*format.Stanza{
+		{Type: ""},
+		{Type: "test", Args: []string{""}},
+		{Type: "test", Args: []string{"a b"}},
+		{Type: "test", Args: []string{"a\nb"}},
+		{Type: "test", Args: []string{"café"}},
+	} {
+		buf.Reset()
+		if err := s.Marshal(buf); err == nil {
+			t.Errorf("Marshal accepted type %q, args %q", s.Type, s.Args)
+		}
+		if buf.Len() != 0 {
+			t.Errorf("Marshal wrote %d bytes", buf.Len())
+		}
+	}
 }
 
 func TestHeaderMarshalNoStanzas(t *testing.T) {