]> Cypherpunks repositories - gostls13.git/commit
[release-branch.go1.18] path/filepath: fix stack exhaustion in Glob
authorJulie Qiu <julieqiu@google.com>
Thu, 23 Jun 2022 23:18:56 +0000 (23:18 +0000)
committerMichael Knyszek <mknyszek@google.com>
Tue, 12 Jul 2022 15:06:43 +0000 (15:06 +0000)
commit5ebd862b1714dad1544bd10a24c47cdb53ad7f46
tree6a3798cc137f8446909cf5c8e758a326b0f3c7af
parent315e80d293b684ac2902819e58f618f1b5a14d49
[release-branch.go1.18] path/filepath: fix stack exhaustion in Glob

A limit is added to the number of path separators allowed by an input to
Glob, to prevent stack exhaustion issues.

Thanks to Juho Nurminen of Mattermost who reported the issue.

Fixes #53714
Updates #53416
Fixes CVE-2022-30632

Change-Id: I1b9fd4faa85411a05dbc91dceae1c0c8eb021f07
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1498176
Reviewed-by: Roland Shoemaker <bracewell@google.com>
(cherry picked from commit d182a6d1217fd0d04c9babfa9a7ccd3515435c39)
Reviewed-on: https://go-review.googlesource.com/c/go/+/417059
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Heschi Kreinick <heschi@google.com>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
src/path/filepath/match.go
src/path/filepath/match_test.go