From ac9a264a575bbbc9de2374a65a6c8fd50c32000d Mon Sep 17 00:00:00 2001 From: liuzekun Date: Mon, 30 Nov 2020 22:18:43 -0500 Subject: [PATCH] golang: fix CVE-2020-28367 Upstream: https://github.com/golang/go/commit/da7aa86917811a571e6634b45a457f918b8e6561 cmd/go: in cgoflags, permit -DX1, prohibit -Wp,-D,opt Restrict -D and -U to ASCII C identifiers, but do permit trailing digits. When using -Wp, prohibit commas in -D values. Change-Id: Ibfc4dfdd6e6c258e131448e7682610c44eee9492 Reviewed-on: https://go-review.googlesource.com/c/go/+/267277 Trust: Ian Lance Taylor Run-TryBot: Ian Lance Taylor TryBot-Result: Go Bot Reviewed-by: Bryan C. Mills --- src/cmd/go/internal/work/security.go | 4 ++-- src/cmd/go/internal/work/security_test.go | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go index 0d8da21..b00c21e 100644 --- a/src/cmd/go/internal/work/security.go +++ b/src/cmd/go/internal/work/security.go @@ -42,7 +42,7 @@ import ( var re = lazyregexp.New var validCompilerFlags = []*lazyregexp.Regexp{ - re(`-D([A-Za-z_].*)`), + re(`-D([A-Za-z_][A-Za-z0-9_]*)(=[^@\-]*)?`), re(`-F([^@\-].*)`), re(`-I([^@\-].*)`), re(`-O`), @@ -50,7 +50,7 @@ var validCompilerFlags = []*lazyregexp.Regexp{ re(`-W`), re(`-W([^@,]+)`), // -Wall but not -Wa,-foo. re(`-Wa,-mbig-obj`), - re(`-Wp,-D([A-Za-z_].*)`), + re(`-Wp,-D([A-Za-z_][A-Za-z0-9_]*)(=[^@,\-]*)?`), re(`-ansi`), re(`-f(no-)?asynchronous-unwind-tables`), re(`-f(no-)?blocks`), diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go index fd8caea..eac029d 100644 --- a/src/cmd/go/internal/work/security_test.go +++ b/src/cmd/go/internal/work/security_test.go @@ -21,6 +21,7 @@ var goodCompilerFlags = [][]string{ {"-Osmall"}, {"-W"}, {"-Wall"}, + {"-Wp,-Dfoo1"}, {"-fobjc-arc"}, {"-fno-objc-arc"}, {"-fomit-frame-pointer"}, @@ -70,6 +71,7 @@ var badCompilerFlags = [][]string{ {"-I-dir"}, {"-O@1"}, {"-Wa,-foo"}, + {"-Wp,-DX,-D@X"}, {"-W@foo"}, {"-g@gdb"}, {"-g-gdb"}, -- 2.19.1