cmd/go: enforce -Wl,--push-state logic only when it is a prefix

Make sure we only run the --push-state logic when -Wl,--push-state is a
prefix of the argument, not just present in the argument string.

Thanks to Juho Forsén of Mattermost for reporting this issue.

Change-Id: I799f7854ff680674fd84cf2136fadf70817fc7e2
Reviewed-on: https://go-review.googlesource.com/c/go/+/628415
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>

diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
index e48dffdb7fdf4fe93b3f34cdfe707a229921928e..1e2f81b2d4d23e5cf9fd74aa52a8a16d3d4a744f 100644 (file)
--- a/src/cmd/go/internal/work/security.go
+++ b/src/cmd/go/internal/work/security.go
@@ -312,7 +312,7 @@ Args:
                for _, re := range valid {
                        if match := re.FindString(arg); match == arg { // must be complete match
                                continue Args
-                       } else if match == "-Wl,--push-state" {
+                       } else if strings.HasPrefix(arg, "-Wl,--push-state,") {
                                // Examples for --push-state are written
                                //     -Wl,--push-state,--as-needed
                                // Support other commands in the same -Wl arg.

diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go
index 1cb0aa8e4a9a2bf0019a325a7b37c128ea2fa62b..63dd569f7d3964a705571ee5cd0aecd359ab5a17 100644 (file)
--- a/src/cmd/go/internal/work/security_test.go
+++ b/src/cmd/go/internal/work/security_test.go
@@ -250,6 +250,8 @@ var badLinkerFlags = [][]string{
        {"-Wl,-R,-flag"},
        {"-Wl,--push-state,"},
        {"-Wl,--push-state,@foo"},
+       {"-fplugin=./-Wl,--push-state,-R.so"},
+       {"./-Wl,--push-state,-R.c"},
 }
 
 func TestCheckLinkerFlags(t *testing.T) {