qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-11 18:31:38 -07:00
Code Releases Activity

[release-branch.go1.17] path/filepath: fix stack exhaustion in Glob

Browse Source 
A limit is added to the number of path separators allowed by an input to
Glob, to prevent stack exhaustion issues.

Thanks to Juho Nurminen of Mattermost who reported the issue.

Fixes #53713
Updates #53416
Fixes CVE-2022-30632

Change-Id: I1b9fd4faa85411a05dbc91dceae1c0c8eb021f07
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1498176
Reviewed-by: Roland Shoemaker <bracewell@google.com>
(cherry picked from commit d182a6d1217fd0d04c9babfa9a7ccd3515435c39)
Reviewed-on: https://go-review.googlesource.com/c/go/+/417073
Reviewed-by: Heschi Kreinick <heschi@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
This commit is contained in:
Julie Qiu 2022-06-23 23:18:56 +00:00 committed by Michael Knyszek
parent 8c1d8c8362
commit 76f8b7304d
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/path/filepath/match.go
View File

@ -241,6 +241,16 @@ func getEsc(chunk string) (r rune, nchunk string, err error) {
// The only possible returned error is ErrBadPattern, when pattern
// is malformed.
func Glob(pattern string) (matches []string, err error) {
return globWithLimit(pattern, 0)
}
func globWithLimit(pattern string, depth int) (matches []string, err error) {
// This limit is used prevent stack exhaustion issues. See CVE-2022-30632.
const pathSeparatorsLimit = 10000
if depth == pathSeparatorsLimit {
return nil, ErrBadPattern
}
// Check pattern is well-formed.
if _, err := Match(pattern, ""); err != nil {
return nil, err
@ -270,7 +280,7 @@ func Glob(pattern string) (matches []string, err error) {
}
var m []string
m, err = Glob(dir)
m, err = globWithLimit(dir, depth+1)
if err != nil {
return
}

10
src/path/filepath/match_test.go
View File

@ -155,6 +155,16 @@ func TestGlob(t *testing.T) {
}
}
func TestCVE202230632(t *testing.T) {
// Prior to CVE-2022-30632, this would cause a stack exhaustion given a
// large number of separators (more than 4,000,000). There is now a limit
// of 10,000.
_, err := Glob("/*" + strings.Repeat("/", 10001))
if err != ErrBadPattern {
t.Fatalf("Glob returned err=%v, want ErrBadPattern", err)
}
}
func TestGlobError(t *testing.T) {
bad := []string{`[]`, `nonexist/[]`}
for _, pattern := range bad {