diff options
author | Michael Knyszek <mknyszek@google.com> | 2021-09-02 16:51:59 -0400 |
---|---|---|
committer | Michael Knyszek <mknyszek@google.com> | 2021-10-07 14:55:06 +0000 |
commit | 4548fcc8dfd933c237f29bba6f90040a85922564 (patch) | |
tree | e3958e795b94ac9551736f5448d3dbe06c74fd50 /VERSION | |
parent | 7d573240307331c2dc9edfbb11ebbaa6bc677e99 (diff) | |
download | go-4548fcc8dfd933c237f29bba6f90040a85922564.tar.gz go-4548fcc8dfd933c237f29bba6f90040a85922564.zip |
[release-branch.go1.16] misc/wasm, cmd/link: do not let command line args overwrite global data
On Wasm, wasm_exec.js puts command line arguments at the beginning
of the linear memory (following the "zero page"). Currently there
is no limit for this, and a very long command line can overwrite
the program's data section. Prevent this by limiting the command
line to 4096 bytes, and in the linker ensuring the data section
starts at a high enough address (8192).
(Arguably our address assignment on Wasm is a bit confusing. This
is the minimum fix I can come up with.)
Thanks to Ben Lubar for reporting this issue.
Change by Cherry Mui <cherryyz@google.com>.
For #48797
Fixes #48799
Fixes CVE-2021-38297
Change-Id: I0f50fbb2a5b6d0d047e3c134a88988d9133e4ab3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1205933
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Than McIntosh <thanm@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/354591
Trust: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Heschi Kreinick <heschi@google.com>
Diffstat (limited to 'VERSION')
0 files changed, 0 insertions, 0 deletions