1
0
mirror of https://github.com/golang/go synced 2024-09-23 09:33:31 -06:00
go/src/encoding
Roland Shoemaker 08c84420bc encoding/gob: cover missed cases when checking ignore depth
This change makes sure that we are properly checking the ignored field
recursion depth in decIgnoreOpFor consistently. This prevents stack
exhaustion when attempting to decode a message that contains an
extremely deeply nested struct which is ignored.

Thanks to Md Sakib Anwar of The Ohio State University (anwar.40@osu.edu)
for reporting this issue.

Fixes #69139
Fixes CVE-2024-34156

Change-Id: Iacce06be95a5892b3064f1c40fcba2e2567862d6
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1440
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/611239
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
2024-09-05 16:42:09 +00:00
..
ascii85
asn1 encoding: use slices and maps to clean up tests 2024-07-25 00:23:58 +00:00
base32 encoding/base32, encoding/base64: document Decode to short buffer 2024-08-30 19:38:50 +00:00
base64 encoding/base32, encoding/base64: document Decode to short buffer 2024-08-30 19:38:50 +00:00
binary encoding/binary: add missing test helper calls 2024-07-23 19:17:29 +00:00
csv encoding: use slices and maps to clean up tests 2024-07-25 00:23:58 +00:00
gob encoding/gob: cover missed cases when checking ignore depth 2024-09-05 16:42:09 +00:00
hex encoding/hex: don't overallocate memory in DecodeString 2024-05-08 19:30:23 +00:00
json encoding/json: add embedded structs to the UnmarshalTypeError's Field 2024-09-03 15:49:47 +00:00
pem encoding: use slices and maps to clean up tests 2024-07-25 00:23:58 +00:00
xml encoding/xml: allow ]]> in attribute values 2024-09-04 13:33:11 +00:00
encoding.go encoding: add TextAppender and BinaryAppender 2024-07-30 14:22:50 +00:00