]> Cypherpunks repositories - gostls13.git/commit
encoding/xml: limit depth of nesting in unmarshal
authorRoland Shoemaker <roland@golang.org>
Tue, 29 Mar 2022 22:52:09 +0000 (15:52 -0700)
committerMichael Knyszek <mknyszek@google.com>
Tue, 12 Jul 2022 15:05:33 +0000 (15:05 +0000)
commitc4c1993fd2a5b26fe45c09592af6d3388a3b2e08
treec9fcd79b62f65e7c2bda9d3e4bb6e4a34a7928a5
parent913d05133c7fb3adfd2b1a34a47d635d8e072fa2
encoding/xml: limit depth of nesting in unmarshal

Prevent exhausting the stack limit when unmarshalling extremely deeply
nested structures into nested types.

Fixes #53611
Fixes CVE-2022-30633

Change-Id: Ic6c5d41674c93cfc9a316135a408db9156d39c59
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1421319
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/417061
Run-TryBot: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Heschi Kreinick <heschi@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
src/encoding/xml/read.go
src/encoding/xml/read_test.go