tree 33979afde9e60e999a2de1d1f9cf1d23faf11e69
parent 3a82255431918bb7c2e1c09c964a18991756910b
author Katie Hockman <katie@golang.org> 1591901430 -0400
committer Katie Hockman <katie@golang.org> 1592332123 +0000

encoding/unicode: correctly handle single-byte UTF-16 inputs (and harden transform.String)

If a single byte is passed to a UTF-16 decoder
with atEOF set, it should not ask for more src
with ErrShortSrc but return an error. Also harden
transform.String not to enter an infinite loop if a
Transformer does return ErrShortSrc with atEOF true.

Fixes #39491
Fixes CVE-2020-14040

Change-Id: If8d2a9bca4eb9b4270c98a4967d356082043e17e
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/768667
Reviewed-by: Filippo Valsorda <valsorda@google.com>
Reviewed-on: https://go-review.googlesource.com/c/text/+/238238
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>