From 14d0bb39c1c4093bd02740d14b1a2ca720ced97c Mon Sep 17 00:00:00 2001 From: Neal Patel Date: Tue, 6 Jan 2026 16:09:19 -0500 Subject: [PATCH] [release-branch.go1.24] cmd/go: remove user-content from doc strings in cgo ASTs. Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Updates #76697 Fixes #77128 Fixes CVE-2025-61732 Change-Id: Ie2a96b79a813e362cbf8e6cb0e3c2d0c022bcb29 Reviewed-on: https://go-review.googlesource.com/c/go/+/740001 LUCI-TryBot-Result: Go LUCI Auto-Submit: Dmitri Shuralyov Reviewed-by: Roland Shoemaker --- src/cmd/cgo/ast.go | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/src/cmd/cgo/ast.go b/src/cmd/cgo/ast.go index 861479db7a..11f5831ccd 100644 --- a/src/cmd/cgo/ast.go +++ b/src/cmd/cgo/ast.go @@ -301,17 +301,12 @@ func (f *File) saveExport(x interface{}, context astContext) { error_(c.Pos(), "export comment has wrong name %q, want %q", name, n.Name.Name) } - doc := "" - for _, c1 := range n.Doc.List { - if c1 != c { - doc += c1.Text + "\n" - } - } - f.ExpFunc = append(f.ExpFunc, &ExpFunc{ Func: n, ExpName: name, - Doc: doc, + // Caution: Do not set the Doc field on purpose + // to ensure that there are no unintended artifacts + // in the binary. See https://go.dev/issue/76697. }) break } -- 2.52.0