go, branch go1.21.8

[release-branch.go1.21] go1.21.8

2024-03-05T17:38:51Z

Change-Id: I44203158172ca3e66f8ce4ab84f54c9247dacb28 Reviewed-on: https://go-review.googlesource.com/c/go/+/569256 Reviewed-by: Carlos Amedee Reviewed-by: Michael Knyszek Auto-Submit: Gopher Robot LUCI-TryBot-Result: Go LUCI

[release-branch.go1.21] net/textproto, mime/multipart: avoid unbounded read in MIME header

2024-03-05T16:51:36Z

mime/multipart.Reader.ReadForm allows specifying the maximum amount of memory that will be consumed by the form. While this limit is correctly applied to the parsed form data structure, it was not being applied to individual header lines in a form. For example, when presented with a form containing a header line that never ends, ReadForm will continue to read the line until it runs out of memory. Limit the amount of data consumed when reading a header. Fixes CVE-2023-45290 Fixes #65389 For #65383 Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435 Reviewed-by: Roland Shoemaker Reviewed-by: Tatiana Bradley Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2173776 Reviewed-by: Carlos Amedee Reviewed-on: https://go-review.googlesource.com/c/go/+/569240 Auto-Submit: Michael Knyszek LUCI-TryBot-Result: Go LUCI Reviewed-by: Carlos Amedee

[release-branch.go1.21] net/http, net/http/cookiejar: avoid subdomain matches on IPv6 zones

2024-03-05T16:51:34Z

When deciding whether to forward cookies or sensitive headers across a redirect, do not attempt to interpret an IPv6 address as a domain name. Avoids a case where a maliciously-crafted redirect to an IPv6 address with a scoped addressing zone could be misinterpreted as a within-domain redirect. For example, we could interpret "::1%.www.example.com" as a subdomain of "www.example.com". Thanks to Juho Nurminen of Mattermost for reporting this issue. Fixes CVE-2023-45289 Fixes #65385 For #65065 Change-Id: I8f463f59f0e700c8a18733d2b264a8bcb3a19599 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2131938 Reviewed-by: Tatiana Bradley Reviewed-by: Roland Shoemaker Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2173775 Reviewed-by: Carlos Amedee Reviewed-on: https://go-review.googlesource.com/c/go/+/569239 Reviewed-by: Carlos Amedee Auto-Submit: Michael Knyszek TryBot-Bypass: Michael Knyszek

[release-branch.go1.21] crypto/x509: make sure pub key is non-nil before interface conversion

2024-03-05T16:44:27Z

alreadyInChain assumes all keys fit a interface which contains the Equal method (which they do), but this ignores that certificates may have a nil key when PublicKeyAlgorithm is UnknownPublicKeyAlgorithm. In this case alreadyInChain panics. Check that the key is non-nil as part of considerCandidate (we are never going to build a chain containing UnknownPublicKeyAlgorithm anyway). For #65390 Fixes #65392 Fixes CVE-2024-24783 Change-Id: Ibdccc0a487e3368b6812be35daad2512220243f3 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2137282 Reviewed-by: Damien Neil Run-TryBot: Roland Shoemaker Reviewed-by: Tatiana Bradley Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2173774 Reviewed-by: Roland Shoemaker Reviewed-by: Carlos Amedee Reviewed-on: https://go-review.googlesource.com/c/go/+/569238 Auto-Submit: Michael Knyszek LUCI-TryBot-Result: Go LUCI Reviewed-by: Carlos Amedee

[release-branch.go1.21] html/template: escape additional tokens in MarshalJSON errors

2024-02-28T19:53:41Z

Escape " Reviewed-by: Damien Neil (cherry picked from commit ccbc725f2d678255df1bd326fa511a492aa3a0aa) Reviewed-on: https://go-review.googlesource.com/c/go/+/567515 Reviewed-by: Carlos Amedee

[release-branch.go1.21] internal/syscall/windows: fix the signature of SetFileInformationByHandle

2024-02-28T19:46:24Z

Also fix its call site in internal/poll to pass the length of the actual buffer instead of an unrelated variable, and update the definition of FILE_BASIC_INFO to match the documented field types and add padding that is empirically needed on the 386 architecture. Passing a pointer to a Go-allocated buffer as type uintptr violates the unsafe.Pointer conversion rules, which allow such a conversion only in the call expression itself for a call to syscall.Syscall or equivalent. That can allow the buffer to be corrupted arbitrarily if the Go runtime happens to garbage-collect it while the call to SetFileInformationByHandle is in progress. The Microsoft documentation for SetFileInformationByHandle specifies its third argument type as LPVOID, which corresponds to Go's unsafe.Pointer, not uintptr. Fixes #65882. Updates #58933. Change-Id: If577b57adea9922f5fcca55e46030c703d8f035c Cq-Include-Trybots: luci.golang.try:go1.21-windows-amd64-longtest Reviewed-on: https://go-review.googlesource.com/c/go/+/549256 LUCI-TryBot-Result: Go LUCI Reviewed-by: Than McIntosh Auto-Submit: Bryan Mills Reviewed-by: Quim Muntal Reviewed-by: Alex Brainman (cherry picked from commit a7097243e462802f3055da9f843013e450a75092) Reviewed-on: https://go-review.googlesource.com/c/go/+/566155 Reviewed-by: Bryan Mills

[release-branch.go1.21] net/mail: properly handle special characters in phrase and obs-phrase

2024-02-28T19:10:06Z

Fixes a couple of misalignments with RFC 5322 which introduce significant diffs between (mostly) conformant parsers. This change reverts the changes made in CL50911, which allowed certain special RFC 5322 characters to appear unquoted in the "phrase" syntax. It is unclear why this change was made in the first place, and created a divergence from comformant parsers. In particular this resulted in treating comments in display names incorrectly. Additionally properly handle trailing malformed comments in the group syntax. For #65083 Fixes #65848 Change-Id: I00dddc044c6ae3381154e43236632604c390f672 Reviewed-on: https://go-review.googlesource.com/c/go/+/555596 Reviewed-by: Damien Neil LUCI-TryBot-Result: Go LUCI Reviewed-on: https://go-review.googlesource.com/c/go/+/566195 Reviewed-by: Carlos Amedee

[release-branch.go1.21] cmd/go/internal/modcmd: correctly filter out main modules in verify

2024-02-28T17:54:30Z

This change fixes a bug where we incorrectly filtered out the main modules from the beginning of the build list before verifying them. We made the assumption that the first MainModules.Len() entries of the build list were the main modules, but now it can contain the go and toolchain version entries, so removing the first MainModules.Len() entries could leave main module names in the build list if any of their names sorted after the string 'go'. For #62663 Fixes #65851 Change-Id: I35ab6857a556f58d306303322afe24c48fc8b38f Reviewed-on: https://go-review.googlesource.com/c/go/+/565378 Reviewed-by: Bryan Mills LUCI-TryBot-Result: Go LUCI (cherry picked from commit 3f60da7944352d7f2d4a04830c0612457643016c) Reviewed-on: https://go-review.googlesource.com/c/go/+/565755 Run-TryBot: Michael Matloob TryBot-Result: Gopher Robot

[release-branch.go1.21] runtime: don't let the tests leave core files behind

2024-02-27T21:42:04Z

Also add a check that we didn't leave any core files behind. For #65476. Fixes #65478. Change-Id: I30444ef43ad1a8cc1cacd3b75280f2128e104939 Reviewed-on: https://go-review.googlesource.com/c/go/+/525175 Reviewed-by: Ian Lance Taylor Reviewed-by: Keith Randall Auto-Submit: Ian Lance Taylor Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI Reviewed-by: Keith Randall (cherry picked from commit cffdfe8d2cabbe874bceaeed1eba92cc567be6db) Reviewed-on: https://go-review.googlesource.com/c/go/+/560896

[release-branch.go1.21] cmd/cgo/internal/testsanitizers: disable location checking for clang

2024-02-16T15:51:02Z

Pending a resolution to #65606, this CL marks clang's ASAN runtime as unable to symbolize stack traces to unblock the LUCI clang builder. For #65606. For #65469. Fixes #65640. Change-Id: I649773085aff30e5703e7f7ac2c72a0430a015c2 Cq-Include-Trybots: luci.golang.try:go1.21-linux-amd64-clang15 Reviewed-on: https://go-review.googlesource.com/c/go/+/562675 Reviewed-by: Dmitri Shuralyov Reviewed-by: Dmitri Shuralyov LUCI-TryBot-Result: Go LUCI (cherry picked from commit d94ab597af9b3f8e8ba371023314d80f6b3be5a5) Reviewed-on: https://go-review.googlesource.com/c/go/+/562999