From 17436af8413071a50515c90af69c23f77cb201e3 Mon Sep 17 00:00:00 2001 From: "Bryan C. Mills" Date: Wed, 3 Apr 2019 09:45:48 -0400 Subject: [PATCH] cmd/go/internal/modload: fix aliasing bug in (*mvsReqs).Required with -mod=vendor (*mvsReqs).Required assumes that it is safe to mutate the slice returned by (*mvsReqs).required. In most cases, that was true, but in the case of -mod=vendor it resulted in unsynchronized (and potentially interfering) writes to the global vendorList. Fixes #30550 Change-Id: I99bcc2037e0182418b7dfda1002f8b540dbf3a1d Reviewed-on: https://go-review.googlesource.com/c/go/+/170598 Run-TryBot: Bryan C. Mills TryBot-Result: Gobot Gobot Reviewed-by: Brad Fitzpatrick --- src/cmd/go/internal/modload/load.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/cmd/go/internal/modload/load.go b/src/cmd/go/internal/modload/load.go index d55e0c5403..ea0ac6771f 100644 --- a/src/cmd/go/internal/modload/load.go +++ b/src/cmd/go/internal/modload/load.go @@ -976,27 +976,27 @@ func readVendorList() { } func (r *mvsReqs) modFileToList(f *modfile.File) []module.Version { - var list []module.Version + list := make([]module.Version, 0, len(f.Require)) for _, r := range f.Require { list = append(list, r.Mod) } return list } +// required returns a unique copy of the requirements of mod. func (r *mvsReqs) required(mod module.Version) ([]module.Version, error) { if mod == Target { if modFile != nil && modFile.Go != nil { r.versions.LoadOrStore(mod, modFile.Go.Version) } - var list []module.Version - return append(list, r.buildList[1:]...), nil + return append([]module.Version(nil), r.buildList[1:]...), nil } if cfg.BuildMod == "vendor" { // For every module other than the target, // return the full list of modules from modules.txt. readVendorList() - return vendorList, nil + return append([]module.Version(nil), vendorList...), nil } if targetInGorootSrc { -- 2.50.0