cmd/go/internal/modload: fix aliasing bug in (*mvsReqs).Required with -mod=vendor

(*mvsReqs).Required assumes that it is safe to mutate the slice
returned by (*mvsReqs).required. In most cases, that was true, but in
the case of -mod=vendor it resulted in unsynchronized (and
potentially interfering) writes to the global vendorList.

Fixes #30550

Change-Id: I99bcc2037e0182418b7dfda1002f8b540dbf3a1d
Reviewed-on: https://go-review.googlesource.com/c/go/+/170598
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

diff --git a/src/cmd/go/internal/modload/load.go b/src/cmd/go/internal/modload/load.go
index d55e0c54034b9828dd3c5372c5070a6cd3a424fa..ea0ac6771fba43b9ebe15259665c60d5b0e5364f 100644 (file)
--- a/src/cmd/go/internal/modload/load.go
+++ b/src/cmd/go/internal/modload/load.go
@@ -976,27 +976,27 @@ func readVendorList() {
 }
 
 func (r *mvsReqs) modFileToList(f *modfile.File) []module.Version {
-       var list []module.Version
+       list := make([]module.Version, 0, len(f.Require))
        for _, r := range f.Require {
                list = append(list, r.Mod)
        }
        return list
 }
 
+// required returns a unique copy of the requirements of mod.
 func (r *mvsReqs) required(mod module.Version) ([]module.Version, error) {
        if mod == Target {
                if modFile != nil && modFile.Go != nil {
                        r.versions.LoadOrStore(mod, modFile.Go.Version)
                }
-               var list []module.Version
-               return append(list, r.buildList[1:]...), nil
+               return append([]module.Version(nil), r.buildList[1:]...), nil
        }
 
        if cfg.BuildMod == "vendor" {
                // For every module other than the target,
                // return the full list of modules from modules.txt.
                readVendorList()
-               return vendorList, nil
+               return append([]module.Version(nil), vendorList...), nil
        }
 
        if targetInGorootSrc {