diff options
| author | Roland Shoemaker <bracewell@google.com> | 2024-06-10 15:34:12 -0700 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2024-09-05 16:42:07 +0000 |
| commit | dd2019528b669908f8ccc0c327a64d0e07fc2a1b (patch) | |
| tree | fdfbdce802660d3828e907fa6571a45731432cf5 /src/encoding | |
| parent | 73fa90e2908d525efb9f7ad0dbcfceb5f25c7251 (diff) | |
| download | go-dd2019528b669908f8ccc0c327a64d0e07fc2a1b.tar.xz | |
go/parser: track depth in nested element lists
Prevents stack exhaustion with extremely deeply nested literal values,
i.e. field values in structs.
Fixes #69138
Fixes CVE-2024-34155
Change-Id: I2e8e33b44105cc169d7ed1ae83fb56df0c10f1ee
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1520
Reviewed-by: Robert Griesemer <gri@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Russ Cox <rsc@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/611238
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Diffstat (limited to 'src/encoding')
0 files changed, 0 insertions, 0 deletions