mirror
/
go
mirror of https://github.com/golang/go.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
The Go programming language
59,341 Commits 63 Branches 451 Tags 660 MiB
Go 94.3%
Assembly 5.3%
C 0.2%
Shell 0.1%
Go to file
Damien Neil 16e5d24480 net/textproto, mime/multipart: avoid unbounded read in MIME header 
mime/multipart.Reader.ReadForm allows specifying the maximum amount
of memory that will be consumed by the form. While this limit is
correctly applied to the parsed form data structure, it was not
being applied to individual header lines in a form.

For example, when presented with a form containing a header line
that never ends, ReadForm will continue to read the line until it
runs out of memory.

Limit the amount of data consumed when reading a header.

Fixes CVE-2023-45290
Fixes #65383

Change-Id: I7f9264d25752009e95f6b2c80e3d76aaf321d658
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2134435
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/569341
Reviewed-by: Carlos Amedee <carlos@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
 		2024-03-05 18:31:56 +00:00
.github github: switch seen/expected order in issue forms 2024-01-04 23:31:17 +00:00
api reflect: add Overflow methods to Type 2024-02-28 14:08:38 +00:00
doc os: fix 63703.md release notes 2024-03-05 16:20:15 +00:00
lib/time lib/time: use consistent directory in mkzip usage message 2024-03-04 17:32:07 +00:00
misc misc/wasm: support new wasmtime CLI 2023-11-19 21:11:54 +00:00
src net/textproto, mime/multipart: avoid unbounded read in MIME header 2024-03-05 18:31:56 +00:00
test cmd/compile: add 0-sized-value simplification to copyelim 2024-03-02 14:01:52 +00:00
.gitattributes
…
.gitignore internal/platform,cmd/dist: export the list of supported platforms 2023-06-22 19:44:52 +00:00
CONTRIBUTING.md doc: normalize proposal-process links 2023-03-29 22:00:27 +00:00
LICENSE
…
PATENTS
…
README.md README: update from CC-BY-3.0 to CC-BY-4.0 2022-11-02 20:14:56 +00:00
SECURITY.md SECURITY.md: update the Reporting a Vulnerability link 2023-09-22 21:17:24 +00:00
codereview.cfg
…
go.env cmd/go: additional doc-inspired tests and bug fixes 2023-06-06 19:18:46 +00:00

README.md

The Go Programming Language

Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.

Gopher image Gopher image by Renee French, licensed under Creative Commons 4.0 Attributions license.

Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Download and Install

Binary Distributions

Official binary distributions are available at https://go.dev/dl/.

After downloading a binary release, visit https://go.dev/doc/install for installation instructions.

Install From Source

If a binary distribution is not available for your combination of operating system and architecture, visit https://go.dev/doc/install/source for source installation instructions.

Contributing

Go is the work of thousands of contributors. We appreciate your help!

To contribute, please read the contribution guidelines at https://go.dev/doc/contribute.

Note that the Go project uses the issue tracker for bug reports and proposals only. See https://go.dev/wiki/Questions for a list of places to ask questions about the Go language.