diff options
| author | Roland Shoemaker <roland@golang.org> | 2022-03-29 15:52:09 -0700 |
|---|---|---|
| committer | Michael Knyszek <mknyszek@google.com> | 2022-07-12 15:20:25 +0000 |
| commit | 2678d0c957193dceef336c969a9da74dd716a827 (patch) | |
| tree | 6db6a3c0e877a290cd403c60d6ddb1936141f02f /src/go/parser/parser_test.go | |
| parent | 58facfbe7db2fbb9afed794b281a70bdb12a60ae (diff) | |
| download | go-2678d0c957193dceef336c969a9da74dd716a827.tar.gz go-2678d0c957193dceef336c969a9da74dd716a827.zip | |
[release-branch.go1.17] encoding/xml: limit depth of nesting in unmarshal
Prevent exhausting the stack limit when unmarshalling extremely deeply
nested structures into nested types.
Fixes #53715
Updates #53611
Fixes CVE-2022-30633
Change-Id: Ic6c5d41674c93cfc9a316135a408db9156d39c59
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1421319
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Julie Qiu <julieqiu@google.com>
(cherry picked from commit ebee00a55e28931b2cad0e76207a73712b000432)
Reviewed-on: https://go-review.googlesource.com/c/go/+/417069
Reviewed-by: Heschi Kreinick <heschi@google.com>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Diffstat (limited to 'src/go/parser/parser_test.go')
0 files changed, 0 insertions, 0 deletions