cvefix: fix CVE-2023-29402,CVE-2023-29403,CVE-2023-29404,CVE-2023-29405
This commit is contained in:
hanchao
parent
4ba5829313
commit
fd63bbeeb8
1545
0043-Backport-runtime-implement-SUID-SGID-protections.patch
Normal file
1545
0043-Backport-runtime-implement-SUID-SGID-protections.patch
Normal file
File diff suppressed because it is too large
Load Diff
208
0044-Backport-cmd-go-disallow-package-directories-contain.patch
Normal file
208
0044-Backport-cmd-go-disallow-package-directories-contain.patch
Normal file
@ -0,0 +1,208 @@
|
|||||||
|
From 8eddf81239a58bbdbb700c8cc46e8e671b20108c Mon Sep 17 00:00:00 2001
|
||||||
|
From: "Bryan C. Mills" <bcmills@google.com>
|
||||||
|
Date: Sat, 13 May 2023 02:15:16 +0800
|
||||||
|
Subject: [PATCH 2/4] [Backport] cmd/go: disallow package directories
|
||||||
|
containing newlines
|
||||||
|
|
||||||
|
Offering: Cloud Core Network
|
||||||
|
CVE: CVE-2023-29402
|
||||||
|
Reference: https://go-review.googlesource.com/c/go/+/501218
|
||||||
|
|
||||||
|
Directory or file paths containing newlines may cause tools (such as
|
||||||
|
cmd/cgo) that emit "//line" or "#line" -directives to write part of
|
||||||
|
the path into non-comment lines in generated source code. If those
|
||||||
|
lines contain valid Go code, it may be injected into the resulting
|
||||||
|
binary.
|
||||||
|
|
||||||
|
(Note that Go import paths and file paths within module zip files
|
||||||
|
already could not contain newlines.)
|
||||||
|
|
||||||
|
Thanks to Juho Nurminen of Mattermost for reporting this issue.
|
||||||
|
|
||||||
|
Note: The upstream does not submit this change to go1.17 according to the rules of MinorReleases.
|
||||||
|
Corego3.x are based on go1.17.8. Therefore, it need to submit the change to corego3.x.
|
||||||
|
|
||||||
|
Edited-by: tangxi t00586138
|
||||||
|
|
||||||
|
Updates #60167.
|
||||||
|
Fixes #60515.
|
||||||
|
Fixes CVE-2023-29402.
|
||||||
|
|
||||||
|
Change-Id: If55d0400c02beb7a5da5eceac60f1abeac99f064
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1882606
|
||||||
|
Reviewed-by: Roland Shoemaker <bracewell@google.com>
|
||||||
|
Run-TryBot: Roland Shoemaker <bracewell@google.com>
|
||||||
|
Reviewed-by: Russ Cox <rsc@google.com>
|
||||||
|
Reviewed-by: Damien Neil <dneil@google.com>
|
||||||
|
(cherry picked from commit 41f9046495564fc728d6f98384ab7276450ac7e2)
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902229
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904343
|
||||||
|
Reviewed-by: Michael Knyszek <mknyszek@google.com>
|
||||||
|
Reviewed-by: Bryan Mills <bcmills@google.com>
|
||||||
|
Reviewed-on: https://go-review.googlesource.com/c/go/+/501218
|
||||||
|
Run-TryBot: David Chase <drchase@google.com>
|
||||||
|
Auto-Submit: Michael Knyszek <mknyszek@google.com>
|
||||||
|
TryBot-Result: Gopher Robot <gobot@golang.org>
|
||||||
|
Signed-off-by: Tang Xi tangxi6@huawei.com
|
||||||
|
|
||||||
|
---
|
||||||
|
src/cmd/go/internal/load/pkg.go | 4 +
|
||||||
|
src/cmd/go/internal/work/exec.go | 6 ++
|
||||||
|
src/cmd/go/script_test.go | 1 +
|
||||||
|
.../go/testdata/script/build_cwd_newline.txt | 100 ++++++++++++++++++
|
||||||
|
4 files changed, 111 insertions(+)
|
||||||
|
create mode 100644 src/cmd/go/testdata/script/build_cwd_newline.txt
|
||||||
|
|
||||||
|
diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
|
||||||
|
index a83cc9a812..d4da86dbe8 100644
|
||||||
|
--- a/src/cmd/go/internal/load/pkg.go
|
||||||
|
+++ b/src/cmd/go/internal/load/pkg.go
|
||||||
|
@@ -1897,6 +1897,10 @@ func (p *Package) load(ctx context.Context, opts PackageOpts, path string, stk *
|
||||||
|
setError(fmt.Errorf("invalid input directory name %q", name))
|
||||||
|
return
|
||||||
|
}
|
||||||
|
+ if strings.ContainsAny(p.Dir, "\r\n") {
|
||||||
|
+ setError(fmt.Errorf("invalid package directory %q", p.Dir))
|
||||||
|
+ return
|
||||||
|
+ }
|
||||||
|
|
||||||
|
// Build list of imported packages and full dependency list.
|
||||||
|
imports := make([]*Package, 0, len(p.Imports))
|
||||||
|
diff --git a/src/cmd/go/internal/work/exec.go b/src/cmd/go/internal/work/exec.go
|
||||||
|
index 5a225fb9f1..2eb8bd681c 100644
|
||||||
|
--- a/src/cmd/go/internal/work/exec.go
|
||||||
|
+++ b/src/cmd/go/internal/work/exec.go
|
||||||
|
@@ -503,6 +503,12 @@ func (b *Builder) build(ctx context.Context, a *Action) (err error) {
|
||||||
|
b.Print(a.Package.ImportPath + "\n")
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if p.Error != nil {
|
||||||
|
+ // Don't try to build anything for packages with errors. There may be a
|
||||||
|
+ // problem with the inputs that makes the package unsafe to build.
|
||||||
|
+ return p.Error
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if a.Package.BinaryOnly {
|
||||||
|
p.Stale = true
|
||||||
|
p.StaleReason = "binary-only packages are no longer supported"
|
||||||
|
diff --git a/src/cmd/go/script_test.go b/src/cmd/go/script_test.go
|
||||||
|
index 639e907db0..80b93566ea 100644
|
||||||
|
--- a/src/cmd/go/script_test.go
|
||||||
|
+++ b/src/cmd/go/script_test.go
|
||||||
|
@@ -181,6 +181,7 @@ func (ts *testScript) setup() {
|
||||||
|
"devnull=" + os.DevNull,
|
||||||
|
"goversion=" + goVersion(ts),
|
||||||
|
":=" + string(os.PathListSeparator),
|
||||||
|
+ "newline=\n",
|
||||||
|
}
|
||||||
|
if !testenv.HasExternalNetwork() {
|
||||||
|
ts.env = append(ts.env, "TESTGONETWORK=panic", "TESTGOVCS=panic")
|
||||||
|
diff --git a/src/cmd/go/testdata/script/build_cwd_newline.txt b/src/cmd/go/testdata/script/build_cwd_newline.txt
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..61c6966b02
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/src/cmd/go/testdata/script/build_cwd_newline.txt
|
||||||
|
@@ -0,0 +1,100 @@
|
||||||
|
+[windows] skip 'filesystem normalizes / to \'
|
||||||
|
+[plan9] skip 'filesystem disallows \n in paths'
|
||||||
|
+
|
||||||
|
+# If the directory path containing a package to be built includes a newline,
|
||||||
|
+# the go command should refuse to even try to build the package.
|
||||||
|
+
|
||||||
|
+env DIR=$WORK${/}${newline}'package main'${newline}'func main() { panic("uh-oh")'${newline}'/*'
|
||||||
|
+
|
||||||
|
+mkdir $DIR
|
||||||
|
+cd $DIR
|
||||||
|
+exec pwd
|
||||||
|
+cp $WORK/go.mod ./go.mod
|
||||||
|
+cp $WORK/main.go ./main.go
|
||||||
|
+cp $WORK/main_test.go ./main_test.go
|
||||||
|
+
|
||||||
|
+! go build -o $devnull .
|
||||||
|
+stderr 'package example: invalid package directory .*uh-oh'
|
||||||
|
+
|
||||||
|
+! go build -o $devnull main.go
|
||||||
|
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
|
||||||
|
+
|
||||||
|
+! go run .
|
||||||
|
+stderr 'package example: invalid package directory .*uh-oh'
|
||||||
|
+
|
||||||
|
+! go run main.go
|
||||||
|
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
|
||||||
|
+
|
||||||
|
+! go test .
|
||||||
|
+stderr 'package example: invalid package directory .*uh-oh'
|
||||||
|
+
|
||||||
|
+! go test -v main.go main_test.go
|
||||||
|
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+# Since we do preserve $PWD (or set it appropriately) for commands, and we do
|
||||||
|
+# not resolve symlinks unnecessarily, referring to the contents of the unsafe
|
||||||
|
+# directory via a safe symlink should be ok, and should not inject the data from
|
||||||
|
+# the symlink target path.
|
||||||
|
+
|
||||||
|
+[!symlink] stop 'remainder of test checks symlink behavior'
|
||||||
|
+[short] stop 'links and runs binaries'
|
||||||
|
+
|
||||||
|
+symlink $WORK${/}link -> $DIR
|
||||||
|
+
|
||||||
|
+go run $WORK${/}link${/}main.go
|
||||||
|
+! stdout panic
|
||||||
|
+! stderr panic
|
||||||
|
+stderr '^ok$'
|
||||||
|
+
|
||||||
|
+go test -v $WORK${/}link${/}main.go $WORK${/}link${/}main_test.go
|
||||||
|
+! stdout panic
|
||||||
|
+! stderr panic
|
||||||
|
+stdout '^ok$' # 'go test' combines the test's stdout into stderr
|
||||||
|
+
|
||||||
|
+cd $WORK/link
|
||||||
|
+
|
||||||
|
+! go run $DIR${/}main.go
|
||||||
|
+stderr 'package command-line-arguments: invalid package directory .*uh-oh'
|
||||||
|
+
|
||||||
|
+go run .
|
||||||
|
+! stdout panic
|
||||||
|
+! stderr panic
|
||||||
|
+stderr '^ok$'
|
||||||
|
+
|
||||||
|
+go run main.go
|
||||||
|
+! stdout panic
|
||||||
|
+! stderr panic
|
||||||
|
+stderr '^ok$'
|
||||||
|
+
|
||||||
|
+go test -v
|
||||||
|
+! stdout panic
|
||||||
|
+! stderr panic
|
||||||
|
+stdout '^ok$' # 'go test' combines the test's stdout into stderr
|
||||||
|
+
|
||||||
|
+go test -v .
|
||||||
|
+! stdout panic
|
||||||
|
+! stderr panic
|
||||||
|
+stdout '^ok$' # 'go test' combines the test's stdout into stderr
|
||||||
|
+
|
||||||
|
+
|
||||||
|
+-- $WORK/go.mod --
|
||||||
|
+module example
|
||||||
|
+go 1.19
|
||||||
|
+-- $WORK/main.go --
|
||||||
|
+package main
|
||||||
|
+
|
||||||
|
+import "C"
|
||||||
|
+
|
||||||
|
+func main() {
|
||||||
|
+ /* nothing here */
|
||||||
|
+ println("ok")
|
||||||
|
+}
|
||||||
|
+-- $WORK/main_test.go --
|
||||||
|
+package main
|
||||||
|
+
|
||||||
|
+import "testing"
|
||||||
|
+
|
||||||
|
+func TestMain(*testing.M) {
|
||||||
|
+ main()
|
||||||
|
+}
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
@ -0,0 +1,87 @@
|
|||||||
|
From 8b67461159daa77c536d2d0a0cbf7f67c742a3e5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Roland Shoemaker <bracewell@google.com>
|
||||||
|
Date: Fri, 5 May 2023 13:10:34 -0700
|
||||||
|
Subject: [PATCH 3/4] [Backport] cmd/go: enforce flags with non-optional
|
||||||
|
arguments
|
||||||
|
|
||||||
|
Offering: Cloud Core Network
|
||||||
|
CVE: CVE-2023-29404
|
||||||
|
Reference: https://go-review.googlesource.com/c/go/+/501217
|
||||||
|
|
||||||
|
Enforce that linker flags which expect arguments get them, otherwise it
|
||||||
|
may be possible to smuggle unexpected flags through as the linker can
|
||||||
|
consume what looks like a flag as an argument to a preceding flag (i.e.
|
||||||
|
"-Wl,-O -Wl,-R,-bad-flag" is interpreted as "-O=-R -bad-flag"). Also be
|
||||||
|
somewhat more restrictive in the general format of some flags.
|
||||||
|
|
||||||
|
Thanks to Juho Nurminen of Mattermost for reporting this issue.
|
||||||
|
|
||||||
|
Updates #60305
|
||||||
|
Fixes #60511
|
||||||
|
Fixes CVE-2023-29404
|
||||||
|
|
||||||
|
Change-Id: Icdffef2c0f644da50261cace6f43742783931cff
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1876275
|
||||||
|
Reviewed-by: Ian Lance Taylor <iant@google.com>
|
||||||
|
Reviewed-by: Damien Neil <dneil@google.com>
|
||||||
|
(cherry picked from commit 896779503cf754cbdac24b61d4cc953b50fe2dde)
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902225
|
||||||
|
Run-TryBot: Roland Shoemaker <bracewell@google.com>
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904342
|
||||||
|
Reviewed-by: Michael Knyszek <mknyszek@google.com>
|
||||||
|
Reviewed-on: https://go-review.googlesource.com/c/go/+/501217
|
||||||
|
Auto-Submit: Michael Knyszek <mknyszek@google.com>
|
||||||
|
Run-TryBot: David Chase <drchase@google.com>
|
||||||
|
TryBot-Bypass: Michael Knyszek <mknyszek@google.com>
|
||||||
|
Signed-off-by: Tang Xi tangxi6@huawei.com
|
||||||
|
|
||||||
|
---
|
||||||
|
src/cmd/go/internal/work/security.go | 6 +++---
|
||||||
|
src/cmd/go/internal/work/security_test.go | 5 +++++
|
||||||
|
2 files changed, 8 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/src/cmd/go/internal/work/security.go b/src/cmd/go/internal/work/security.go
|
||||||
|
index e9b9f6c6c0..91e6e4c86b 100644
|
||||||
|
--- a/src/cmd/go/internal/work/security.go
|
||||||
|
+++ b/src/cmd/go/internal/work/security.go
|
||||||
|
@@ -179,10 +179,10 @@ var validLinkerFlags = []*lazyregexp.Regexp{
|
||||||
|
re(`-Wl,-berok`),
|
||||||
|
re(`-Wl,-Bstatic`),
|
||||||
|
re(`-Wl,-Bsymbolic-functions`),
|
||||||
|
- re(`-Wl,-O([^@,\-][^,]*)?`),
|
||||||
|
+ re(`-Wl,-O[0-9]+`),
|
||||||
|
re(`-Wl,-d[ny]`),
|
||||||
|
re(`-Wl,--disable-new-dtags`),
|
||||||
|
- re(`-Wl,-e[=,][a-zA-Z0-9]*`),
|
||||||
|
+ re(`-Wl,-e[=,][a-zA-Z0-9]+`),
|
||||||
|
re(`-Wl,--enable-new-dtags`),
|
||||||
|
re(`-Wl,--end-group`),
|
||||||
|
re(`-Wl,--(no-)?export-dynamic`),
|
||||||
|
@@ -191,7 +191,7 @@ var validLinkerFlags = []*lazyregexp.Regexp{
|
||||||
|
re(`-Wl,--hash-style=(sysv|gnu|both)`),
|
||||||
|
re(`-Wl,-headerpad_max_install_names`),
|
||||||
|
re(`-Wl,--no-undefined`),
|
||||||
|
- re(`-Wl,-R([^@\-][^,@]*$)`),
|
||||||
|
+ re(`-Wl,-R,?([^@\-,][^,@]*$)`),
|
||||||
|
re(`-Wl,--just-symbols[=,]([^,@\-][^,@]+)`),
|
||||||
|
re(`-Wl,-rpath(-link)?[=,]([^,@\-][^,]+)`),
|
||||||
|
re(`-Wl,-s`),
|
||||||
|
diff --git a/src/cmd/go/internal/work/security_test.go b/src/cmd/go/internal/work/security_test.go
|
||||||
|
index 8d4be0abfc..3616548d1b 100644
|
||||||
|
--- a/src/cmd/go/internal/work/security_test.go
|
||||||
|
+++ b/src/cmd/go/internal/work/security_test.go
|
||||||
|
@@ -227,6 +227,11 @@ var badLinkerFlags = [][]string{
|
||||||
|
{"-Wl,-R,@foo"},
|
||||||
|
{"-Wl,--just-symbols,@foo"},
|
||||||
|
{"../x.o"},
|
||||||
|
+ {"-Wl,-R,"},
|
||||||
|
+ {"-Wl,-O"},
|
||||||
|
+ {"-Wl,-e="},
|
||||||
|
+ {"-Wl,-e,"},
|
||||||
|
+ {"-Wl,-R,-flag"},
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestCheckLinkerFlags(t *testing.T) {
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
120
0046-Backport-cmd-go-cmd-cgo-in-_cgo_flags-use-one-line-p.patch
Normal file
120
0046-Backport-cmd-go-cmd-cgo-in-_cgo_flags-use-one-line-p.patch
Normal file
@ -0,0 +1,120 @@
|
|||||||
|
From 646a6420b6cdf9dbea6d9e16b67021a7942be8fc Mon Sep 17 00:00:00 2001
|
||||||
|
From: Ian Lance Taylor <iant@golang.org>
|
||||||
|
Date: Thu, 4 May 2023 14:06:39 -0700
|
||||||
|
Subject: [PATCH 4/4] [Backport] cmd/go,cmd/cgo: in _cgo_flags use one line per
|
||||||
|
flag
|
||||||
|
|
||||||
|
Offering: Cloud Core Network
|
||||||
|
CVE: CVE-2023-29405
|
||||||
|
Reference: https://go-review.googlesource.com/c/go/+/501216
|
||||||
|
|
||||||
|
The flags that we recorded in _cgo_flags did not use any quoting,
|
||||||
|
so a flag containing embedded spaces was mishandled.
|
||||||
|
Change the _cgo_flags format to put each flag on a separate line.
|
||||||
|
That is a simple format that does not require any quoting.
|
||||||
|
|
||||||
|
As far as I can tell only cmd/go uses _cgo_flags, and it is only
|
||||||
|
used for gccgo. If this patch doesn't cause any trouble, then
|
||||||
|
in the next release we can change to only using _cgo_flags for gccgo.
|
||||||
|
|
||||||
|
Thanks to Juho Nurminen of Mattermost for reporting this issue.
|
||||||
|
|
||||||
|
Note: Merged with CL: https://go-review.googlesource.com/c/go/+/501297
|
||||||
|
|
||||||
|
Edited-by: tangxi t00586138
|
||||||
|
|
||||||
|
Updates #60306
|
||||||
|
Fixes #60513
|
||||||
|
Fixes CVE-2023-29405
|
||||||
|
|
||||||
|
Change-Id: Id738a737ecae47babb34c4b4fc4d65336cf0c0f3
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1875094
|
||||||
|
Reviewed-by: Damien Neil <dneil@google.com>
|
||||||
|
Reviewed-by: Roland Shoemaker <bracewell@google.com>
|
||||||
|
(cherry picked from commit bcdfcadd5612212089d958bc352a6f6c90742dcc)
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1902227
|
||||||
|
Run-TryBot: Roland Shoemaker <bracewell@google.com>
|
||||||
|
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1904341
|
||||||
|
Reviewed-by: Michael Knyszek <mknyszek@google.com>
|
||||||
|
Reviewed-on: https://go-review.googlesource.com/c/go/+/501216
|
||||||
|
Auto-Submit: Michael Knyszek <mknyszek@google.com>
|
||||||
|
Run-TryBot: David Chase <drchase@google.com>
|
||||||
|
TryBot-Bypass: David Chase <drchase@google.com>
|
||||||
|
Signed-off-by: Tang Xi tangxi6@huawei.com
|
||||||
|
|
||||||
|
---
|
||||||
|
src/cmd/cgo/out.go | 4 +++-
|
||||||
|
src/cmd/go/internal/work/gccgo.go | 14 ++++++-------
|
||||||
|
.../go/testdata/script/gccgo_link_ldflags.txt | 20 +++++++++++++++++++
|
||||||
|
3 files changed, 29 insertions(+), 9 deletions(-)
|
||||||
|
create mode 100644 src/cmd/go/testdata/script/gccgo_link_ldflags.txt
|
||||||
|
|
||||||
|
diff --git a/src/cmd/cgo/out.go b/src/cmd/cgo/out.go
|
||||||
|
index 94152f4278..62e6528f60 100644
|
||||||
|
--- a/src/cmd/cgo/out.go
|
||||||
|
+++ b/src/cmd/cgo/out.go
|
||||||
|
@@ -47,7 +47,9 @@ func (p *Package) writeDefs() {
|
||||||
|
|
||||||
|
fflg := creat(*objDir + "_cgo_flags")
|
||||||
|
for k, v := range p.CgoFlags {
|
||||||
|
- fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, strings.Join(v, " "))
|
||||||
|
+ for _, arg := range v {
|
||||||
|
+ fmt.Fprintf(fflg, "_CGO_%s=%s\n", k, arg)
|
||||||
|
+ }
|
||||||
|
if k == "LDFLAGS" && !*gccgo {
|
||||||
|
for _, arg := range v {
|
||||||
|
fmt.Fprintf(fgo2, "//go:cgo_ldflag %q\n", arg)
|
||||||
|
diff --git a/src/cmd/go/internal/work/gccgo.go b/src/cmd/go/internal/work/gccgo.go
|
||||||
|
index 1499536932..bb4be2fd10 100644
|
||||||
|
--- a/src/cmd/go/internal/work/gccgo.go
|
||||||
|
+++ b/src/cmd/go/internal/work/gccgo.go
|
||||||
|
@@ -283,14 +283,12 @@ func (tools gccgoToolchain) link(b *Builder, root *Action, out, importcfg string
|
||||||
|
const ldflagsPrefix = "_CGO_LDFLAGS="
|
||||||
|
for _, line := range strings.Split(string(flags), "\n") {
|
||||||
|
if strings.HasPrefix(line, ldflagsPrefix) {
|
||||||
|
- newFlags := strings.Fields(line[len(ldflagsPrefix):])
|
||||||
|
- for _, flag := range newFlags {
|
||||||
|
- // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS
|
||||||
|
- // but they don't mean anything to the linker so filter
|
||||||
|
- // them out.
|
||||||
|
- if flag != "-g" && !strings.HasPrefix(flag, "-O") {
|
||||||
|
- cgoldflags = append(cgoldflags, flag)
|
||||||
|
- }
|
||||||
|
+ flag := line[len(ldflagsPrefix):]
|
||||||
|
+ // Every _cgo_flags file has -g and -O2 in _CGO_LDFLAGS
|
||||||
|
+ // but they don't mean anything to the linker so filter
|
||||||
|
+ // them out.
|
||||||
|
+ if flag != "-g" && !strings.HasPrefix(flag, "-O") {
|
||||||
|
+ cgoldflags = append(cgoldflags, flag)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
diff --git a/src/cmd/go/testdata/script/gccgo_link_ldflags.txt b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..4e91ae5650
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/src/cmd/go/testdata/script/gccgo_link_ldflags.txt
|
||||||
|
@@ -0,0 +1,20 @@
|
||||||
|
+# Test that #cgo LDFLAGS are properly quoted.
|
||||||
|
+# The #cgo LDFLAGS below should pass a string with spaces to -L,
|
||||||
|
+# as though searching a directory with a space in its name.
|
||||||
|
+# It should not pass --nosuchoption to the external linker.
|
||||||
|
+
|
||||||
|
+[!cgo] skip
|
||||||
|
+
|
||||||
|
+go build
|
||||||
|
+
|
||||||
|
+[!exec:gccgo] skip
|
||||||
|
+
|
||||||
|
+go build -compiler gccgo
|
||||||
|
+
|
||||||
|
+-- go.mod --
|
||||||
|
+module m
|
||||||
|
+-- cgo.go --
|
||||||
|
+package main
|
||||||
|
+// #cgo LDFLAGS: -L "./ -Wl,--nosuchoption"
|
||||||
|
+import "C"
|
||||||
|
+func main() {}
|
||||||
|
--
|
||||||
|
2.33.0
|
||||||
|
|
||||||
12
golang.spec
12
golang.spec
@ -63,7 +63,7 @@
|
|||||||
|
|
||||||
Name: golang
|
Name: golang
|
||||||
Version: 1.17.3
|
Version: 1.17.3
|
||||||
Release: 18
|
Release: 19
|
||||||
Summary: The Go Programming Language
|
Summary: The Go Programming Language
|
||||||
License: BSD and Public Domain
|
License: BSD and Public Domain
|
||||||
URL: https://golang.org/
|
URL: https://golang.org/
|
||||||
@ -192,6 +192,10 @@ Patch6039: 0039-release-branch.go1.19-mime-multipart-limit-parsed-mi.patch
|
|||||||
Patch6040: 0040-Backport-html-template-emit-filterFailsafe-for-empty.patch
|
Patch6040: 0040-Backport-html-template-emit-filterFailsafe-for-empty.patch
|
||||||
Patch6041: 0041-Backport-html-template-handle-all-JS-whitespace-char.patch
|
Patch6041: 0041-Backport-html-template-handle-all-JS-whitespace-char.patch
|
||||||
Patch6042: 0042-Backport-html-template-disallow-angle-brackets-in-CS.patch
|
Patch6042: 0042-Backport-html-template-disallow-angle-brackets-in-CS.patch
|
||||||
|
Patch6043: 0043-Backport-runtime-implement-SUID-SGID-protections.patch
|
||||||
|
Patch6044: 0044-Backport-cmd-go-disallow-package-directories-contain.patch
|
||||||
|
Patch6045: 0045-Backport-cmd-go-enforce-flags-with-non-optional-argu.patch
|
||||||
|
Patch6046: 0046-Backport-cmd-go-cmd-cgo-in-_cgo_flags-use-one-line-p.patch
|
||||||
|
|
||||||
ExclusiveArch: %{golang_arches}
|
ExclusiveArch: %{golang_arches}
|
||||||
|
|
||||||
@ -430,6 +434,12 @@ fi
|
|||||||
%files devel -f go-tests.list -f go-misc.list -f go-src.list
|
%files devel -f go-tests.list -f go-misc.list -f go-src.list
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jun 21 2023 hanchao <hanchao63@huawei.com> - 1.17.3-19
|
||||||
|
- Type:CVE
|
||||||
|
- CVE:CVE-2023-29402,CVE-2023-29403,CVE-2023-29404,CVE-2023-29405
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:fix CVE-2023-29402,CVE-2023-29403,CVE-2023-29404,CVE-2023-29405
|
||||||
|
|
||||||
* Mon May 22 2023 hanchao <hanchao63@huawei.com> - 1.17.3-18
|
* Mon May 22 2023 hanchao <hanchao63@huawei.com> - 1.17.3-18
|
||||||
- Type:CVE
|
- Type:CVE
|
||||||
- CVE:CVE-2023-29400,CVE-2023-24539,CVE-2023-24540
|
- CVE:CVE-2023-29400,CVE-2023-24539,CVE-2023-24540
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user