tree 2a4e911fcd01ed5c8eacdd6ee3f56ecb3789c01c
parent c4c1993fd2a5b26fe45c09592af6d3388a3b2e08
author Roland Shoemaker <roland@golang.org> 1648518086 -0700
committer Michael Knyszek <mknyszek@google.com> 1657638339 +0000

encoding/xml: use iterative Skip, rather than recursive

Prevents exhausting the stack limit in _incredibly_ deeply nested
structures.

Fixes #53614
Fixes CVE-2022-28131

Change-Id: I47db4595ce10cecc29fbd06afce7b299868599e6
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1419912
Reviewed-by: Julie Qiu <julieqiu@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/417062
Run-TryBot: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Heschi Kreinick <heschi@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>