go, branch go1.8.7

[release-branch.go1.8] go1.8.7

2018-02-07T15:33:09Z

Change-Id: Ida9b4f44033f33657dad213f65b0c85ad89b08a7 Reviewed-on: https://team-review.git.corp.google.com/213169 Reviewed-by: Andrew Bonventre

[release-branch.go1.8] doc: document Go 1.8.7

2018-02-07T15:33:05Z

Change-Id: I7ea97312bdf489c2833b1823dd633eb55f3bcd72 Reviewed-on: https://team-review.git.corp.google.com/213168 Reviewed-by: Andrew Bonventre

[release-branch.go1.8] cmd/go: accept only limited compiler and linker flags in #cgo directives

2018-02-07T14:16:33Z

Both gcc and clang accept an option -fplugin=code.so to load a plugin from the ELF shared object file code.so. Obviously that plugin can then do anything it wants during the build. This is contrary to the goal of "go get" never running untrusted code during the build. (What happens if you choose to run the result of the build is your responsibility.) Disallow this behavior by only allowing a small set of known command-line flags in #cgo CFLAGS directives (and #cgo LDFLAGS, etc). The new restrictions can be adjusted by the environment variables CGO_CFLAGS_ALLOW, CGO_CFLAGS_DISALLOW, and so on. See the documentation. In addition to excluding cgo-defined flags, we also have to make sure that when we pass file names on the command line, they don't look like flags. So we now refuse to build packages containing suspicious file names like -x.go. A wrinkle in all this is that GNU binutils uniformly accept @foo on the command line to mean "if the file foo exists, then substitute its contents for @foo in the command line". So we must also reject @x.go, flags and flag arguments beginning with @, and so on. Fixes #23674, CVE-2018-6574. Change-Id: I59e7c1355155c335a5c5ae0d2cf8fa7aa313940a Reviewed-on: https://team-review.git.corp.google.com/212688 Reviewed-by: Ian Lance Taylor

[release-branch.go1.8] go1.8.6

2018-01-23T03:33:54Z

Change-Id: I0aeac01cb7a4329129351d3175f11a0a50b7466c Reviewed-on: https://go-review.googlesource.com/89195 Run-TryBot: Andrew Bonventre TryBot-Result: Gobot Gobot Reviewed-by: Andrew Bonventre

[release-branch.go1.8] doc: document Go 1.8.6

2018-01-23T03:27:44Z

Update golang/go#23515 Change-Id: Id334d8663bf4cbb68f224d1bba4c9ad3855f8aae Reviewed-on: https://go-review.googlesource.com/89155 Reviewed-by: Andrew Gerrand Reviewed-on: https://go-review.googlesource.com/89157 Run-TryBot: Andrew Bonventre TryBot-Result: Gobot Gobot Reviewed-by: Andrew Bonventre

[release-branch.go1.8] math/big: protect against aliasing in nat.divLarge

2018-01-23T03:27:42Z

In nat.divLarge (having signature (z nat).divLarge(u, uIn, v nat)), we check whether z aliases uIn or v, but aliasing is currently not checked for the u parameter. Unfortunately, z and u aliasing each other can in some cases cause errors in the computation. The q return parameter (which will hold the result's quotient), is unconditionally initialized as q = z.make(m + 1) When cap(z) ≥ m+1, z.make() will reuse z's backing array, causing q and z to share the same backing array. If then z aliases u, setting q during the quotient computation will then corrupt u, which at that point already holds computation state. To fix this, we add an alias(z, u) check at the beginning of the function, taking care of aliasing the same way we already do for uIn and v. Fixes #22830 Change-Id: I3ab81120d5af6db7772a062bb1dfc011de91f7ad Reviewed-on: https://go-review.googlesource.com/78995 Run-TryBot: Alberto Donizetti Run-TryBot: Robert Griesemer TryBot-Result: Gobot Gobot Reviewed-by: Robert Griesemer Reviewed-on: https://go-review.googlesource.com/89156 Run-TryBot: Andrew Bonventre Reviewed-by: Andrew Bonventre

[release-branch.go1.8] doc: hide blog content for golang.google.cn

2017-11-30T21:11:42Z

/blog redirects to blog.golang.org (currently blocked in China) unless there is a local checkout of golang.org/x/blog, which is not possible on App Engine Classic. Change-Id: Ia695e663c9bebcc6c3bedea324c630299eaad4dc Reviewed-on: https://go-review.googlesource.com/53051 Reviewed-by: Chris Broadfoot Reviewed-on: https://go-review.googlesource.com/81175 Reviewed-by: Russ Cox

[release-branch.go1.8] doc: hide video and share if being served from CN

2017-11-30T19:41:18Z

In the case where requests are coming from mainland China, hide links to locations that are blocked and functionality that is not permitted. Additionally, some very small cleanup of the JS. This change requires https://go-review.googlesource.com/c/52873 Change-Id: I7fc68748e629dbe5b966d6bf117e7f7b546966eb Reviewed-on: https://go-review.googlesource.com/52872 Reviewed-by: Chris Broadfoot Reviewed-on: https://go-review.googlesource.com/81095 Reviewed-by: Russ Cox

[release-branch.go1.8] go1.8.5

2017-10-25T18:57:21Z

Change-Id: I7c6cf169e84329a31d2d9dc4c52d5c29e80482c9 Reviewed-on: https://go-review.googlesource.com/71350 Run-TryBot: Russ Cox Reviewed-by: Chris Broadfoot TryBot-Result: Gobot Gobot

[release-branch.go1.8] doc: document Go 1.8.5

2017-10-25T18:57:19Z

Change-Id: I9241e6acb65c337b961eed9cdeaf4c041b6326a3 Reviewed-on: https://go-review.googlesource.com/73390 Run-TryBot: Russ Cox Reviewed-by: Chris Broadfoot Reviewed-on: https://go-review.googlesource.com/73392 TryBot-Result: Gobot Gobot