diff options
Diffstat (limited to 'meta/recipes-devtools/go/go-1.14/CVE-2022-30635.patch')
-rw-r--r-- | meta/recipes-devtools/go/go-1.14/CVE-2022-30635.patch | 120 |
1 files changed, 120 insertions, 0 deletions
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2022-30635.patch b/meta/recipes-devtools/go/go-1.14/CVE-2022-30635.patch new file mode 100644 index 0000000000..73959f70fa --- /dev/null +++ b/meta/recipes-devtools/go/go-1.14/CVE-2022-30635.patch | |||
@@ -0,0 +1,120 @@ | |||
1 | From fdd4316737ed5681689a1f40802ffa0805e5b11c Mon Sep 17 00:00:00 2001 | ||
2 | From: Hitendra Prajapati <hprajapati@mvista.com> | ||
3 | Date: Fri, 26 Aug 2022 12:17:05 +0530 | ||
4 | Subject: [PATCH] CVE-2022-30635 | ||
5 | |||
6 | Upstream-Status: Backport [https://github.com/golang/go/commit/cd54600b866db0ad068ab8df06c7f5f6cb55c9b3] | ||
7 | CVE-2022-30635 | ||
8 | Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> | ||
9 | --- | ||
10 | src/encoding/gob/decode.go | 19 ++++++++++++------- | ||
11 | src/encoding/gob/gobencdec_test.go | 24 ++++++++++++++++++++++++ | ||
12 | 2 files changed, 36 insertions(+), 7 deletions(-) | ||
13 | |||
14 | diff --git a/src/encoding/gob/decode.go b/src/encoding/gob/decode.go | ||
15 | index d2f6c74..0e0ec75 100644 | ||
16 | --- a/src/encoding/gob/decode.go | ||
17 | +++ b/src/encoding/gob/decode.go | ||
18 | @@ -871,8 +871,13 @@ func (dec *Decoder) decOpFor(wireId typeId, rt reflect.Type, name string, inProg | ||
19 | return &op | ||
20 | } | ||
21 | |||
22 | +var maxIgnoreNestingDepth = 10000 | ||
23 | + | ||
24 | // decIgnoreOpFor returns the decoding op for a field that has no destination. | ||
25 | -func (dec *Decoder) decIgnoreOpFor(wireId typeId, inProgress map[typeId]*decOp) *decOp { | ||
26 | +func (dec *Decoder) decIgnoreOpFor(wireId typeId, inProgress map[typeId]*decOp, depth int) *decOp { | ||
27 | + if depth > maxIgnoreNestingDepth { | ||
28 | + error_(errors.New("invalid nesting depth")) | ||
29 | + } | ||
30 | // If this type is already in progress, it's a recursive type (e.g. map[string]*T). | ||
31 | // Return the pointer to the op we're already building. | ||
32 | if opPtr := inProgress[wireId]; opPtr != nil { | ||
33 | @@ -896,7 +901,7 @@ func (dec *Decoder) decIgnoreOpFor(wireId typeId, inProgress map[typeId]*decOp) | ||
34 | errorf("bad data: undefined type %s", wireId.string()) | ||
35 | case wire.ArrayT != nil: | ||
36 | elemId := wire.ArrayT.Elem | ||
37 | - elemOp := dec.decIgnoreOpFor(elemId, inProgress) | ||
38 | + elemOp := dec.decIgnoreOpFor(elemId, inProgress, depth+1) | ||
39 | op = func(i *decInstr, state *decoderState, value reflect.Value) { | ||
40 | state.dec.ignoreArray(state, *elemOp, wire.ArrayT.Len) | ||
41 | } | ||
42 | @@ -904,15 +909,15 @@ func (dec *Decoder) decIgnoreOpFor(wireId typeId, inProgress map[typeId]*decOp) | ||
43 | case wire.MapT != nil: | ||
44 | keyId := dec.wireType[wireId].MapT.Key | ||
45 | elemId := dec.wireType[wireId].MapT.Elem | ||
46 | - keyOp := dec.decIgnoreOpFor(keyId, inProgress) | ||
47 | - elemOp := dec.decIgnoreOpFor(elemId, inProgress) | ||
48 | + keyOp := dec.decIgnoreOpFor(keyId, inProgress, depth+1) | ||
49 | + elemOp := dec.decIgnoreOpFor(elemId, inProgress, depth+1) | ||
50 | op = func(i *decInstr, state *decoderState, value reflect.Value) { | ||
51 | state.dec.ignoreMap(state, *keyOp, *elemOp) | ||
52 | } | ||
53 | |||
54 | case wire.SliceT != nil: | ||
55 | elemId := wire.SliceT.Elem | ||
56 | - elemOp := dec.decIgnoreOpFor(elemId, inProgress) | ||
57 | + elemOp := dec.decIgnoreOpFor(elemId, inProgress, depth+1) | ||
58 | op = func(i *decInstr, state *decoderState, value reflect.Value) { | ||
59 | state.dec.ignoreSlice(state, *elemOp) | ||
60 | } | ||
61 | @@ -1073,7 +1078,7 @@ func (dec *Decoder) compileSingle(remoteId typeId, ut *userTypeInfo) (engine *de | ||
62 | func (dec *Decoder) compileIgnoreSingle(remoteId typeId) *decEngine { | ||
63 | engine := new(decEngine) | ||
64 | engine.instr = make([]decInstr, 1) // one item | ||
65 | - op := dec.decIgnoreOpFor(remoteId, make(map[typeId]*decOp)) | ||
66 | + op := dec.decIgnoreOpFor(remoteId, make(map[typeId]*decOp), 0) | ||
67 | ovfl := overflow(dec.typeString(remoteId)) | ||
68 | engine.instr[0] = decInstr{*op, 0, nil, ovfl} | ||
69 | engine.numInstr = 1 | ||
70 | @@ -1118,7 +1123,7 @@ func (dec *Decoder) compileDec(remoteId typeId, ut *userTypeInfo) (engine *decEn | ||
71 | localField, present := srt.FieldByName(wireField.Name) | ||
72 | // TODO(r): anonymous names | ||
73 | if !present || !isExported(wireField.Name) { | ||
74 | - op := dec.decIgnoreOpFor(wireField.Id, make(map[typeId]*decOp)) | ||
75 | + op := dec.decIgnoreOpFor(wireField.Id, make(map[typeId]*decOp), 0) | ||
76 | engine.instr[fieldnum] = decInstr{*op, fieldnum, nil, ovfl} | ||
77 | continue | ||
78 | } | ||
79 | diff --git a/src/encoding/gob/gobencdec_test.go b/src/encoding/gob/gobencdec_test.go | ||
80 | index 6d2c8db..1b52ecc 100644 | ||
81 | --- a/src/encoding/gob/gobencdec_test.go | ||
82 | +++ b/src/encoding/gob/gobencdec_test.go | ||
83 | @@ -12,6 +12,7 @@ import ( | ||
84 | "fmt" | ||
85 | "io" | ||
86 | "net" | ||
87 | + "reflect" | ||
88 | "strings" | ||
89 | "testing" | ||
90 | "time" | ||
91 | @@ -796,3 +797,26 @@ func TestNetIP(t *testing.T) { | ||
92 | t.Errorf("decoded to %v, want 1.2.3.4", ip.String()) | ||
93 | } | ||
94 | } | ||
95 | + | ||
96 | +func TestIngoreDepthLimit(t *testing.T) { | ||
97 | + // We don't test the actual depth limit because it requires building an | ||
98 | + // extremely large message, which takes quite a while. | ||
99 | + oldNestingDepth := maxIgnoreNestingDepth | ||
100 | + maxIgnoreNestingDepth = 100 | ||
101 | + defer func() { maxIgnoreNestingDepth = oldNestingDepth }() | ||
102 | + b := new(bytes.Buffer) | ||
103 | + enc := NewEncoder(b) | ||
104 | + typ := reflect.TypeOf(int(0)) | ||
105 | + nested := reflect.ArrayOf(1, typ) | ||
106 | + for i := 0; i < 100; i++ { | ||
107 | + nested = reflect.ArrayOf(1, nested) | ||
108 | + } | ||
109 | + badStruct := reflect.New(reflect.StructOf([]reflect.StructField{{Name: "F", Type: nested}})) | ||
110 | + enc.Encode(badStruct.Interface()) | ||
111 | + dec := NewDecoder(b) | ||
112 | + var output struct{ Hello int } | ||
113 | + expectedErr := "invalid nesting depth" | ||
114 | + if err := dec.Decode(&output); err == nil || err.Error() != expectedErr { | ||
115 | + t.Errorf("Decode didn't fail with depth limit of 100: want %q, got %q", expectedErr, err) | ||
116 | + } | ||
117 | +} | ||
118 | -- | ||
119 | 2.25.1 | ||
120 | |||