go, branch go1.17.12

[release-branch.go1.17] go1.17.12

2022-07-12T20:15:34Z

Change-Id: I12bfc6a625d61a7a25ecdaa10c8f78953c4c3bcf Reviewed-on: https://go-review.googlesource.com/c/go/+/417178 Run-TryBot: Gopher Robot Auto-Submit: Gopher Robot TryBot-Result: Gopher Robot Reviewed-by: Michael Knyszek Reviewed-by: Heschi Kreinick

[release-branch.go1.17] encoding/gob: add a depth limit for ignored fields

2022-07-12T15:20:44Z

Enforce a nesting limit of 10,000 for ignored fields during decoding of messages. This prevents the possibility of triggering stack exhaustion. Fixes #53709 Updates #53615 Fixes CVE-2022-30635 Change-Id: I05103d06dd5ca3945fcba3c1f5d3b5a645e8fb0f Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1484771 Reviewed-by: Damien Neil Reviewed-by: Tatiana Bradley (cherry picked from commit 55e8f938d22bfec29cc9dc9671044c5a41d1ea9c) Reviewed-on: https://go-review.googlesource.com/c/go/+/417074 Run-TryBot: Heschi Kreinick TryBot-Result: Gopher Robot Reviewed-by: Heschi Kreinick

[release-branch.go1.17] path/filepath: fix stack exhaustion in Glob

2022-07-12T15:20:41Z

A limit is added to the number of path separators allowed by an input to Glob, to prevent stack exhaustion issues. Thanks to Juho Nurminen of Mattermost who reported the issue. Fixes #53713 Updates #53416 Fixes CVE-2022-30632 Change-Id: I1b9fd4faa85411a05dbc91dceae1c0c8eb021f07 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1498176 Reviewed-by: Roland Shoemaker (cherry picked from commit d182a6d1217fd0d04c9babfa9a7ccd3515435c39) Reviewed-on: https://go-review.googlesource.com/c/go/+/417073 Reviewed-by: Heschi Kreinick TryBot-Result: Gopher Robot Run-TryBot: Michael Knyszek

[release-branch.go1.17] io/fs: fix stack exhaustion in Glob

2022-07-12T15:20:37Z

A limit is added to the number of path separators allowed by an input to Glob, to prevent stack exhaustion issues. Thanks to Juho Nurminen of Mattermost who reported a similar issue in path/filepath. Fixes #53719 Updates #53415 Fixes CVE-2022-30630 Change-Id: I5a9d02591fed90cd3d52627f5945f1301e53465d Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1497588 Reviewed-by: Roland Shoemaker (cherry picked from commit fdccc5d7bd0f276d0a8de3a818ca844f0bed5d97) Reviewed-on: https://go-review.googlesource.com/c/go/+/417072 Reviewed-by: Heschi Kreinick TryBot-Result: Gopher Robot Run-TryBot: Michael Knyszek

[release-branch.go1.17] compress/gzip: fix stack exhaustion bug in Reader.Read

2022-07-12T15:20:33Z

Replace recursion with iteration in Reader.Read to avoid stack exhaustion when there are a large number of files. Fixes CVE-2022-30631 Fixes #53717 Updates #53168 Change-Id: I47d8afe3f2d40b0213ab61431df9b221794dbfe0 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1455673 Reviewed-by: Roland Shoemaker Reviewed-by: Julie Qiu (cherry picked from commit cf498969c8a0bae9d7a24b98fc1f66c824a4775d) Reviewed-on: https://go-review.googlesource.com/c/go/+/417071 Reviewed-by: Heschi Kreinick Run-TryBot: Michael Knyszek TryBot-Result: Gopher Robot

[release-branch.go1.17] go/parser: limit recursion depth

2022-07-12T15:20:29Z

Limit nested parsing to 100,000, which prevents stack exhaustion when parsing deeply nested statements, types, and expressions. Also limit the scope depth to 1,000 during object resolution. Thanks to Juho Nurminen of Mattermost for reporting this issue. Fixes #53707 Updates #53616 Fixes CVE-2022-1962 Change-Id: I4d7b86c1d75d0bf3c7af1fdea91582aa74272c64 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1491025 Reviewed-by: Russ Cox Reviewed-by: Damien Neil (cherry picked from commit 6a856f08d58e4b6705c0c337d461c540c1235c83) Reviewed-on: https://go-review.googlesource.com/c/go/+/417070 Reviewed-by: Heschi Kreinick TryBot-Result: Gopher Robot Run-TryBot: Michael Knyszek

[release-branch.go1.17] encoding/xml: limit depth of nesting in unmarshal

2022-07-12T15:20:25Z

Prevent exhausting the stack limit when unmarshalling extremely deeply nested structures into nested types. Fixes #53715 Updates #53611 Fixes CVE-2022-30633 Change-Id: Ic6c5d41674c93cfc9a316135a408db9156d39c59 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1421319 Reviewed-by: Damien Neil Reviewed-by: Julie Qiu (cherry picked from commit ebee00a55e28931b2cad0e76207a73712b000432) Reviewed-on: https://go-review.googlesource.com/c/go/+/417069 Reviewed-by: Heschi Kreinick Run-TryBot: Michael Knyszek TryBot-Result: Gopher Robot

[release-branch.go1.17] encoding/xml: use iterative Skip, rather than recursive

2022-07-12T15:20:21Z

Prevents exhausting the stack limit in _incredibly_ deeply nested structures. Fixes #53711 Updates #53614 Fixes CVE-2022-28131 Change-Id: I47db4595ce10cecc29fbd06afce7b299868599e6 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1419912 Reviewed-by: Julie Qiu Reviewed-by: Damien Neil (cherry picked from commit 9278cb78443d2b4deb24cbb5b61c9ba5ac688d49) Reviewed-on: https://go-review.googlesource.com/c/go/+/417068 TryBot-Result: Gopher Robot Reviewed-by: Heschi Kreinick Run-TryBot: Michael Knyszek

[release-branch.go1.17] net/http: preserve nil values in Header.Clone

2022-07-12T14:51:39Z

ReverseProxy makes a distinction between nil and zero-length header values. Avoid losing nil-ness when cloning a request. Thanks to Christian Mehlmauer for discovering this. For #53423 For CVE-2022-32148 Fixes #53620 Change-Id: Ice369cdb4712e2d62e25bb881b080847aa4801f5 Reviewed-on: https://go-review.googlesource.com/c/go/+/412857 Reviewed-by: Ian Lance Taylor Reviewed-by: Brad Fitzpatrick (cherry picked from commit b2cc0fecc2ccd80e6d5d16542cc684f97b3a9c8a) Reviewed-on: https://go-review.googlesource.com/c/go/+/415221 Reviewed-by: Heschi Kreinick TryBot-Result: Gopher Robot Run-TryBot: Michael Knyszek Run-TryBot: Heschi Kreinick Reviewed-by: Michael Knyszek

[release-branch.go1.17] net/http: don't strip whitespace from Transfer-Encoding headers

2022-07-12T14:50:37Z

Do not accept "Transfer-Encoding: \rchunked" as a valid TE header setting chunked encoding. Thanks to Zeyu Zhang (https://www.zeyu2001.com/) for identifying the issue. For #53188 For CVE-2022-1705 Fixes #53432 Change-Id: I1a16631425159267f2eca68056b057192a7edf6c Reviewed-on: https://go-review.googlesource.com/c/go/+/409874 Reviewed-by: Roland Shoemaker Reviewed-by: Brad Fitzpatrick (cherry picked from commit e5017a93fcde94f09836200bca55324af037ee5f) Reviewed-on: https://go-review.googlesource.com/c/go/+/415217 Reviewed-by: Dmitri Shuralyov Run-TryBot: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov TryBot-Result: Gopher Robot