cmd/go: prevent infinite loop in QueryPackage()

p = path.Dir(p) converges to either "." or "/". The current
implementation of modload.QueryPackage() has a loop that
terminates only on ".", not "/". This leads to the go command
hanging in an infinite loop if the user manages to supply
a file path starting with "/" as package path.

An example of the issue is if the user (incorrectly) attempts
to use an absolute directory path in an import statement within
a module (import "/home/bob/myproj") and then runs go list.

Fixes #27558

Change-Id: Iaa6a4f7b05eba30609373636e50224ae2e7d6158
GitHub-Last-Rev: 3a70d3a4277395c2dd8bb50f61b1ac3e44caee28
GitHub-Pull-Request: golang/go#27976
Reviewed-on: https://go-review.googlesource.com/c/139098
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>

diff --git a/src/cmd/go/internal/modload/query.go b/src/cmd/go/internal/modload/query.go
index 0921d683f04202e02b2dd62938e4fa48e2165eb7..40713413131ae550837112774fe19c3831ed341b 100644 (file)
--- a/src/cmd/go/internal/modload/query.go
+++ b/src/cmd/go/internal/modload/query.go
@@ -221,7 +221,7 @@ func QueryPackage(path, query string, allowed func(module.Version) bool) (module
        }
 
        finalErr := errMissing
-       for p := path; p != "."; p = pathpkg.Dir(p) {
+       for p := path; p != "." && p != "/"; p = pathpkg.Dir(p) {
                info, err := Query(p, query, allowed)
                if err != nil {
                        if _, ok := err.(*codehost.VCSError); ok {