Skip to content

G
go
Switch branch/tag
  1. 07 Feb, 2018 3 commits
    • Russ Cox's avatar
      cmd/go: accept only limited compiler and linker flags in #cgo directives · 1dcb5836
      Russ Cox authored 
      Both gcc and clang accept an option -fplugin=code.so to load
a plugin from the ELF shared object file code.so.
Obviously that plugin can then do anything it wants
during the build. This is contrary to the goal of "go get"
never running untrusted code during the build.
(What happens if you choose to run the result of
the build is your responsibility.)

Disallow this behavior by only allowing a small set of
known command-line flags in #cgo CFLAGS directives
(and #cgo LDFLAGS, etc).

The new restrictions can be adjusted by the environment
variables CGO_CFLAGS_ALLOW, CGO_CFLAGS_DISALLOW,
and so on. See the documentation.

In addition to excluding cgo-defined flags, we also have to
make sure that when we pass file names on the command
line, they don't look like flags. So we now refuse to build
packages containing suspicious file names like -x.go.

A wrinkle in all this is that GNU binutils uniformly accept
@foo on the command line to mean "if the file foo exists,
then substitute its contents for @foo in the command line".
So we must also reject @x.go, flags and flag arguments
beginning with @, and so on.

Fixes #23672, CVE-2018-6574.

Change-Id: I59e7c1355155c335a5c5ae0d2cf8fa7aa313940a
Reviewed-on: https://team-review.git.corp.google.com/209949Reviewed-by: default avatarIan Lance Taylor <iant@google.com>
      1dcb5836
    • Michael Hudson-Doyle's avatar
      cmd/link/internal/loadelf: fix logic for computing ELF flags on ARM · b2d3d6e6
      Michael Hudson-Doyle authored 
      The linker contains complicated logic for figuring out which float ABI to
indicate it is using on (32 bit) ARM systems: it parses a special section in
host object files to look for a flag indicating use of the hard float ABI. When
loadelf got split into its own package a bug was introduced: if the last host
object file does not contain a float ABI related tag, the ELF header's flag was
set to 0, rather than using the value from the last object file which contained
an ABI tag. Fix the code to only change the value used for the ELF header if a
tag was found.

This fixes an extremely confusing build failure on Ubuntu's armhf builders.

Change-Id: I0845d68d082d1383e4cae84ea85164cdc6bcdddb
Reviewed-on: https://go-review.googlesource.com/92515
Run-TryBot: Michael Hudson-Doyle <michael.hudson@canonical.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarIan Lance Taylor <iant@golang.org>
      b2d3d6e6
    • Ian Lance Taylor's avatar
      cmd/cgo: revert CL 49490 "fix for function taking pointer typedef" · c07095cd
      Ian Lance Taylor authored 
      CL 49490 fixed a warning when compiling the C code generated by cgo,
but it introduced typedef conflicts in Go code that cgo is supposed to
avoid.

Original CL description:

    cmd/cgo: fix for function taking pointer typedef

    Fixes #19832

Updates #19832
Fixes #23720

Change-Id: I22a732db31be0b4f7248c105277ab8ee44ef6cfb
Reviewed-on: https://go-review.googlesource.com/92455
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarAustin Clements <austin@google.com>
      c07095cd
  3. 06 Feb, 2018 5 commits
    • Keith Randall's avatar
      cmd/compile: use unsigned loads for multi-element comparisons · 23e8e197
      Keith Randall authored 
      When loading multiple elements of an array into a single register,
make sure we treat them as unsigned.  When treated as signed, the
upper bits might all be set, causing the shift-or combo to clobber
the values higher in the register.

Fixes #23719.

Change-Id: Ic87da03e9bd0fe2c60bb214b99f846e4e9446052
Reviewed-on: https://go-review.googlesource.com/92335
Run-TryBot: Keith Randall <khr@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarIlya Tocar <ilya.tocar@intel.com>
      23e8e197
    • Russ Cox's avatar
      cmd/go: rebuild as needed for tests of packages that add methods · 85bdd05c
      Russ Cox authored 
      If A's external test package imports B, which imports A,
and A's (internal) test code also adds something to A that
invalidates anything in the export data from a build of A
without its test code, then strictly speaking we need to
rebuild B against the test-augmented version of A before
using it to build A's external test package.

We've been skating by without doing this for a very long time,
but I knew we'd need to handle it better eventually,
I planned for it in the new build cache simplifications,
and the code was ready. Now that we have a real-world
test case that needs it, turn on the "proper rebuilding" code.

It doesn't really matter how much things slow down, since
a real-world test cases that caused an internal compiler error
before is now handled correctly, but it appears to be small:
I wasn't able to measure an effect on "go test -a -c fmt".
And of course most builds won't use -a and will be cached well.

Fixes #6204.
Fixes #23701.

Change-Id: I2cd60cf400d1928428979ab05831f48ff7cee6ca
Reviewed-on: https://go-review.googlesource.com/92215
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarIan Lance Taylor <iant@golang.org>
      85bdd05c
    • Ian Lance Taylor's avatar
      text/template: revert CL 66410 "add break, continue actions in ranges" · fd7331a8
      Ian Lance Taylor authored 
      The new break and continue actions do not work in html/template, and
fixing them requires thinking about security issues that seem too
tricky at this stage of the release. We will try again for 1.11.

Original CL description:

    text/template: add break, continue actions in ranges

    Adds the two range control actions "break" and "continue". They act the
    same as the Go keywords break and continue, but are simplified in that
    only the innermost range statement can be broken out of or continued.

    Fixes #20531

Updates #20531
Updates #23683

Change-Id: Ia7fd3c409163e3bcb5dc42947ae90b15bdf89853
Reviewed-on: https://go-review.googlesource.com/92155
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarRuss Cox <rsc@golang.org>
      fd7331a8
    • Daniel Martí's avatar
      cmd/vet: unexported interface{} fields on %s are ok · f54f780d
      Daniel Martí authored 
      For example, the following program is valid:

	type T struct {
		f interface{}
	}

	func main() {
		fmt.Printf("%s", T{"foo"}) // prints {foo}
	}

Since the field is of type interface{}, we might have any value in it.
For example, if we had T{3}, fmt would complain. However, not knowing
what the type under the interface is, we must be conservative.

However, as shown in #17798, we should issue an error if the field's
type is statically known to implement the error or fmt.Stringer
interfaces. In those cases, the user likely wanted the %s format to call
those methods. Keep the vet error in those cases.

While at it, add more field type test cases, such as custom error types,
and interfaces that extend the error interface.

Fixes #23563.

Change-Id: I063885955555917c59da000391b603f0d6dce432
Reviewed-on: https://go-review.googlesource.com/90516
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: default avatarRuss Cox <rsc@golang.org>
Reviewed-by: default avatarIan Lance Taylor <iant@golang.org>
      f54f780d
    • fanzha02's avatar
      cmd/internal/obj/arm64: fix assemble add/adds/sub/subs/cmp/cmn(extended register) bug · a0222ec5
      fanzha02 authored 
      The current code encodes the wrong option value in the binary.

The fix reconstructs the function opxrrr() that does not encode the option
value into the binary value when arguments is sign or zero-extended register.

Add the relevant test cases and negative tests.

Fixes #23501
Change-Id: Ie5850ead2ad08d9a235a5664869aac5051762f1f
Reviewed-on: https://go-review.googlesource.com/88876
Run-TryBot: Cherry Zhang <cherryyz@google.com>
Reviewed-by: default avatarCherry Zhang <cherryyz@google.com>
      a0222ec5
  5. 05 Feb, 2018 3 commits
  7. 02 Feb, 2018 5 commits
  9. 31 Jan, 2018 10 commits
  11. 30 Jan, 2018 7 commits
  13. 29 Jan, 2018 2 commits
  15. 28 Jan, 2018 1 commit
  17. 26 Jan, 2018 2 commits
  19. 25 Jan, 2018 2 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7