diff options
Diffstat (limited to 'src/cmd/compile/internal/gc/noder.go')
| -rw-r--r-- | src/cmd/compile/internal/gc/noder.go | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/cmd/compile/internal/gc/noder.go b/src/cmd/compile/internal/gc/noder.go index 54c48434cc..7cd941206b 100644 --- a/src/cmd/compile/internal/gc/noder.go +++ b/src/cmd/compile/internal/gc/noder.go @@ -7,6 +7,7 @@ package gc import ( "fmt" "os" + "path/filepath" "runtime" "strconv" "strings" @@ -1190,6 +1191,11 @@ func (p *noder) pragma(pos src.Pos, text string) syntax.Pragma { p.linknames = append(p.linknames, linkname{pos, f[1], f[2]}) case strings.HasPrefix(text, "go:cgo_"): + // For security, we disallow //go:cgo_* directives outside cgo-generated files. + // Exception: they are allowed in the standard library, for runtime and syscall. + if !isCgoGeneratedFile(pos) && !compiling_std { + p.error(syntax.Error{Pos: pos, Msg: fmt.Sprintf("//%s only allowed in cgo-generated code", text)}) + } p.pragcgobuf += p.pragcgo(pos, text) fallthrough // because of //go:cgo_unsafe_args default: @@ -1211,6 +1217,16 @@ func (p *noder) pragma(pos src.Pos, text string) syntax.Pragma { return 0 } +// isCgoGeneratedFile reports whether pos is in a file +// generated by cgo, which is to say a file with name +// beginning with "_cgo_". Such files are allowed to +// contain cgo directives, and for security reasons +// (primarily misuse of linker flags), other files are not. +// See golang.org/issue/23672. +func isCgoGeneratedFile(pos src.Pos) bool { + return strings.HasPrefix(filepath.Base(filepath.Clean(pos.AbsFilename())), "_cgo_") +} + func mkname(sym *types.Sym) *Node { n := oldname(sym) if n.Name != nil && n.Name.Pack != nil { |