Cherry Mui 77f2750f43 misc/wasm, cmd/link: do not let command line args overwrite global data ... On Wasm, wasm_exec.js puts command line arguments at the beginning of the linear memory (following the "zero page"). Currently there is no limit for this, and a very long command line can overwrite the program's data section. Prevent this by limiting the command line to 4096 bytes, and in the linker ensuring the data section starts at a high enough address (8192). (Arguably our address assignment on Wasm is a bit confusing. This is the minimum fix I can come up with.) Thanks to Ben Lubar for reporting this issue. Fixes #48797 Fixes CVE-2021-38297 Change-Id: I0f50fbb2a5b6d0d047e3c134a88988d9133e4ab3 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1205933 Reviewed-by: Roland Shoemaker <bracewell@google.com> Reviewed-by: Than McIntosh <thanm@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/354571 Reviewed-by: Cherry Mui <cherryyz@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com> Trust: Michael Knyszek <mknyszek@google.com> Run-TryBot: Michael Knyszek <mknyszek@google.com> TryBot-Result: Go Bot <gobot@golang.org>		2021-10-07 18:45:53 +00:00
..
android	all: gofmt more (but vendor, testdata, and top-level test directories)	2021-08-13 20:45:17 +00:00
arm
cgo	cmd/cgo: update to handle ast.IndexListExpr	2021-10-07 18:02:14 +00:00
chrome/gophertool	docs: fix case of GitHub	2021-03-05 02:35:21 +00:00
ios	all: use bytes.Cut, strings.Cut	2021-10-06 15:53:04 +00:00
linkcheck	all: use bytes.Cut, strings.Cut	2021-10-06 15:53:04 +00:00
reboot	all: gofmt more (but vendor, testdata, and top-level test directories)	2021-08-13 20:45:17 +00:00
swig
trace	all: use HTML5 br tags	2021-03-13 03:38:42 +00:00
wasm	misc/wasm, cmd/link: do not let command line args overwrite global data	2021-10-07 18:45:53 +00:00
editors
go.mod	cmd/cgo: update to handle ast.IndexListExpr	2021-10-07 18:02:14 +00:00