summaryrefslogtreecommitdiffstats
path: root/meta/recipes-bsp/grub/grub2.inc
diff options
context:
space:
mode:
authorPraveen Kumar <praveen.kumar@windriver.com>2025-09-18 21:00:40 +0530
committerSteve Sakoman <steve@sakoman.com>2025-10-03 09:51:17 -0700
commit9ae3736eb488e5ad694a63d7cd92b9d6d090fabd (patch)
treec6d752479a34c67d9dbb6681eed0876c17c26908 /meta/recipes-bsp/grub/grub2.inc
parent51dc9c464de0703bfbc6f1ee71ac9bea20933a45 (diff)
downloadpoky-9ae3736eb488e5ad694a63d7cd92b9d6d090fabd.tar.gz
go: fix CVE-2025-47907
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. Made below changes for Go 1.17 backport: - Replaced `atomic.Pointer[error]` with `atomic.Value`, since atomic pointers are not supported in Go 1.17. - Used errp.(*error) to retrieve and dereference the stored *error, Without this, build fails with: invalid indirect of errp (type interface{}). - Replaced Go 1.18 `any` keyword with `interface{}` for backward compatibility with Go 1.17. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-47907 Upstream-patch: https://github.com/golang/go/commit/8a924caaf348fdc366bab906424616b2974ad4e9 https://github.com/golang/go/commit/298fe517a9333c05143a8a8e1f9d5499f0c6e59b https://github.com/golang/go/commit/c23579f031ecd09bf37c644723b33736dffa8b92 (From OE-Core rev: af9c43c39764ce9ce37785c44dfb83e25cb24703) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-bsp/grub/grub2.inc')
0 files changed, 0 insertions, 0 deletions