diff options
| author | Neal Patel <nealpatel@google.com> | 2026-01-06 16:09:19 -0500 |
|---|---|---|
| committer | Junyang Shao <shaojunyang@google.com> | 2026-01-08 09:58:59 -0800 |
| commit | 6b2505c79cb3838c6e27cf47ac09980fe51c83c2 (patch) | |
| tree | 153d4f1805719d1553bec3d3ca3f547c6f097242 | |
| parent | 4b89bcb8b7141c7e4ef1a7dbb4c3f17f589d89c0 (diff) | |
| download | go-6b2505c79cb3838c6e27cf47ac09980fe51c83c2.tar.xz | |
cmd/go: remove user-content from doc strings in cgo ASTs.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue.
Updates golang/go#76697
Fixes CVE-2025-61732
Change-Id: I1121502f1bf1e91309eb4bd41cc3a09c39366d36
Reviewed-on: https://go-review.googlesource.com/c/go/+/734220
Reviewed-by: Agustin Hernandez <garisol1982@gmail.com>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Robert Griesemer <gri@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
| -rw-r--r-- | src/cmd/cgo/ast.go | 11 |
1 files changed, 3 insertions, 8 deletions
diff --git a/src/cmd/cgo/ast.go b/src/cmd/cgo/ast.go index 2da6ca5a30..df0552f525 100644 --- a/src/cmd/cgo/ast.go +++ b/src/cmd/cgo/ast.go @@ -301,17 +301,12 @@ func (f *File) saveExport(x any, context astContext) { error_(c.Pos(), "export comment has wrong name %q, want %q", name, n.Name.Name) } - doc := "" - for _, c1 := range n.Doc.List { - if c1 != c { - doc += c1.Text + "\n" - } - } - f.ExpFunc = append(f.ExpFunc, &ExpFunc{ Func: n, ExpName: name, - Doc: doc, + // Caution: Do not set the Doc field on purpose + // to ensure that there are no unintended artifacts + // in the binary. See https://go.dev/issue/76697. }) break } |