tree ebe38cf09a612019da30edc542ba65c9918cacf9
parent fa2d41d0ca736f3ad6b200b2a4e134364e9acc59
author Julie Qiu <julieqiu@google.com> 1656026336 +0000
committer Michael Knyszek <mknyszek@google.com> 1657638361 +0000

path/filepath: fix stack exhaustion in Glob

A limit is added to the number of path separators allowed by an input to
Glob, to prevent stack exhaustion issues.

Thanks to Juho Nurminen of Mattermost who reported the issue.

Fixes CVE-2022-30632
Fixes #53416

Change-Id: I1b9fd4faa85411a05dbc91dceae1c0c8eb021f07
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1498176
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/417066
Reviewed-by: Heschi Kreinick <heschi@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Michael Knyszek <mknyszek@google.com>