From 5e0a62c44fbaff6443bffe67911370bc0ea25f6d Mon Sep 17 00:00:00 2001 From: Ian Lance Taylor Date: Wed, 20 Sep 2023 16:16:29 -0700 Subject: [PATCH] cmd/compile: use absolute file name in isCgo check For #23672 Fixes #63211 Fixes CVE-2023-39323 Change-Id: I4586a69e1b2560036afec29d53e53cf25e6c7352 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2032884 Reviewed-by: Matthew Dempsky Reviewed-by: Roland Shoemaker Reviewed-on: https://go-review.googlesource.com/c/go/+/534158 Reviewed-by: Dmitri Shuralyov Reviewed-by: Ian Lance Taylor LUCI-TryBot-Result: Go LUCI Auto-Submit: Ian Lance Taylor Upstream-Status: Backport CVE: CVE-2023-39323 Reference to upstream patch: https://github.com/golang/go/commit/e7c142a19d8b3944c2f1b9ab7fd94c63d8d0c555 Backport patch to fix CVE-2023-39323 and drop the modifications of test codes. Signed-off-by: Libo Chen --- src/cmd/compile/internal/noder/noder.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/cmd/compile/internal/noder/noder.go b/src/cmd/compile/internal/noder/noder.go index 5fcad096c2..f35e065a31 100644 --- a/src/cmd/compile/internal/noder/noder.go +++ b/src/cmd/compile/internal/noder/noder.go @@ -1690,8 +1690,14 @@ func (p *noder) pragma(pos syntax.Pos, blankLine bool, text string, old syntax.P // contain cgo directives, and for security reasons // (primarily misuse of linker flags), other files are not. // See golang.org/issue/23672. +// Note that cmd/go ignores files whose names start with underscore, +// so the only _cgo_ files we will see from cmd/go are generated by cgo. +// It's easy to bypass this check by calling the compiler directly; +// we only protect against uses by cmd/go. func isCgoGeneratedFile(pos syntax.Pos) bool { - return strings.HasPrefix(filepath.Base(filepath.Clean(fileh(pos.Base().Filename()))), "_cgo_") + // We need the absolute file, independent of //line directives, + // so we call pos.Base().Pos().Base(). + return strings.HasPrefix(filepath.Base(filepath.Clean(fileh(pos.Base().Pos().Base().Filename()))), "_cgo_") } // safeArg reports whether arg is a "safe" command-line argument, -- 2.34.1