go, branch go1.16.9

[release-branch.go1.16] go1.16.9

2021-10-07T19:49:45Z

Change-Id: I7328dd94a85b97ec8c3ecf4f56eca9c56a6d806e Reviewed-on: https://go-review.googlesource.com/c/go/+/354593 Trust: Michael Knyszek Run-TryBot: Michael Knyszek Reviewed-by: Heschi Kreinick TryBot-Result: Go Bot

[release-branch.go1.16] misc/wasm, cmd/link: do not let command line args overwrite global data

2021-10-07T14:55:06Z

On Wasm, wasm_exec.js puts command line arguments at the beginning of the linear memory (following the "zero page"). Currently there is no limit for this, and a very long command line can overwrite the program's data section. Prevent this by limiting the command line to 4096 bytes, and in the linker ensuring the data section starts at a high enough address (8192). (Arguably our address assignment on Wasm is a bit confusing. This is the minimum fix I can come up with.) Thanks to Ben Lubar for reporting this issue. Change by Cherry Mui . For #48797 Fixes #48799 Fixes CVE-2021-38297 Change-Id: I0f50fbb2a5b6d0d047e3c134a88988d9133e4ab3 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1205933 Reviewed-by: Roland Shoemaker Reviewed-by: Than McIntosh Reviewed-on: https://go-review.googlesource.com/c/go/+/354591 Trust: Michael Knyszek Reviewed-by: Heschi Kreinick

[release-branch.go1.16] text/template: initialize template before locking it

2021-09-23T21:18:29Z

For #39807 For #48436 Fixes #48443 Change-Id: I75f82fd8738dd2f11f0c69b1230e1be1abc36024 Reviewed-on: https://go-review.googlesource.com/c/go/+/350730 Trust: Ian Lance Taylor Trust: Daniel Martí Run-TryBot: Ian Lance Taylor TryBot-Result: Go Bot Reviewed-by: Daniel Martí (cherry picked from commit ba1c52d7d77724de4407572bd02421c36df3d78a) Reviewed-on: https://go-review.googlesource.com/c/go/+/351116

[release-branch.go1.16] runtime: in adjustTimers back up as far as necessary

2021-09-15T23:27:54Z

When the adjustTimers function removed a timer it assumed it was sufficient to continue the heap traversal at that position. However, in some cases a timer will be moved to an earlier position in the heap. If that timer is timerModifiedEarlier, that can leave timerModifiedEarliest not correctly representing the earlier such timer. Fix the problem by restarting the heap traversal at the earliest changed position. For #47762 Fixes #47858 Change-Id: I152bbe62793ee40a680baf49967bcb89b1f94764 Reviewed-on: https://go-review.googlesource.com/c/go/+/343882 Trust: Ian Lance Taylor Run-TryBot: Ian Lance Taylor TryBot-Result: Go Bot Reviewed-by: Michael Knyszek (cherry picked from commit 2da3375e9b4980e368a8641f54cc53c4af4d1a12) Reviewed-on: https://go-review.googlesource.com/c/go/+/350000

[release-branch.go1.16] go1.16.8

2021-09-09T15:27:16Z

Change-Id: I1926e1506e56fd0484bec71f7b43cee62e41b5b5 Reviewed-on: https://go-review.googlesource.com/c/go/+/348812 Run-TryBot: Than McIntosh TryBot-Result: Go Bot Reviewed-by: Cherry Mui Trust: Than McIntosh

[release-branch.go1.16] text/template: add lock for Template.tmpl to fix data race

2021-09-09T13:49:11Z

This adds a new lock protecting "tmpl". This is a copy of https://golang.org/cl/257817 by Andreas Fleig, updated for current tip, and updated to start running the html/template TestEscapeRace test. Thanks to @bep for providing the test case. For #39807 Fixes #47042 Change-Id: Ic8874484290283a49116812eeaffb8608346dc70 Reviewed-on: https://go-review.googlesource.com/c/go/+/316669 Trust: Ian Lance Taylor Run-TryBot: Ian Lance Taylor TryBot-Result: Go Bot Reviewed-by: Dmitri Shuralyov (cherry picked from commit 496d7c691481966fd6ea806205aa025698a172af) Reviewed-on: https://go-review.googlesource.com/c/go/+/348580 Reviewed-by: Emmanuel Odeke

[release-branch.go1.16] all: update golang.org/x/net to pull in CL 346890

2021-09-02T14:13:09Z

For #47691. Change-Id: I6650fdfc78786fc47a54167bf2f9061422bbb343 Reviewed-on: https://go-review.googlesource.com/c/go/+/347031 Trust: Damien Neil Run-TryBot: Damien Neil TryBot-Result: Go Bot Reviewed-by: Cherry Mui

[release-branch.go1.16] archive/zip: prevent preallocation check from overflowing

2021-09-01T16:41:45Z

If the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, the check that the indicated number of files in the archive can be effectively bypassed. Prevent this from happening by checking that the indicated directory size is less than the size of the archive. Thanks to the OSS-Fuzz project for discovering this issue and to Emmanuel Odeke for reporting it. Fixes #47985 Updates #47801 Fixes CVE-2021-39293 Change-Id: Ifade26b98a40f3b37398ca86bd5252d12394dd24 Reviewed-on: https://go-review.googlesource.com/c/go/+/343434 Trust: Roland Shoemaker Run-TryBot: Roland Shoemaker TryBot-Result: Go Bot Reviewed-by: Russ Cox (cherry picked from commit bacbc33439b124ffd7392c91a5f5d96eca8c0c0b) Reviewed-on: https://go-review.googlesource.com/c/go/+/345409 Reviewed-by: Emmanuel Odeke Run-TryBot: Emmanuel Odeke Trust: Cherry Mui

[release-branch.go1.16] runtime: drop SIGPROF while in ARM < 7 kernel helpers

2021-08-13T16:34:57Z

On Linux ARMv6 and below runtime/internal/atomic.Cas calls into a kernel cas helper at a fixed address. If a SIGPROF arrives while executing the kernel helper, the sigprof lostAtomic logic will miss that we are potentially in the spinlock critical section, which could cause a deadlock when using atomics later in sigprof. For #47505 Fixes #47675 Change-Id: If8ba0d0fc47e45d4e6c68eca98fac4c6ed4e43c1 Reviewed-on: https://go-review.googlesource.com/c/go/+/341889 Trust: Michael Pratt Run-TryBot: Michael Pratt Reviewed-by: Michael Knyszek Reviewed-by: Cherry Mui TryBot-Result: Go Bot (cherry picked from commit 20a620fd9f7bc35739c1af3602d53808d0430814) Reviewed-on: https://go-review.googlesource.com/c/go/+/341853

[release-branch.go1.16] go/internal/gccgoimporter: fix up gccgo installation test

2021-08-11T16:14:09Z

Change the TestInstallationImporter testpoint to query type information for sort.Search instead of sort.Ints. The latter function changed recently (1.16 timeframe), parameter "a" is now "x". A better candidate for this sort of query is sort.Search, which has been stable for a while. Fixes #47610. Change-Id: I314476eac0b0802f86f5cbce32195cab2926db83 Reviewed-on: https://go-review.googlesource.com/c/go/+/294290 Trust: Than McIntosh Run-TryBot: Than McIntosh TryBot-Result: Go Bot Reviewed-by: Ian Lance Taylor (cherry picked from commit 0f66fb7b856b02497cf801ce72d80f375f53358b) Reviewed-on: https://go-review.googlesource.com/c/go/+/340952