From 778152173274e56bf43b18de3531ab59893552a2 Mon Sep 17 00:00:00 2001 From: Julie Qiu Date: Thu, 23 Jun 2022 23:18:56 +0000 Subject: [PATCH] [go-1.15.15-eks] path/filepath: fix stack exhaustion in Glob # AWS EKS Backported To: go-1.15.15-eks Backported On: Thu, 22 Sept 2022 Backported By: budris@amazon.com Backported From: release-branch.go1.17 EKS Patch Source Commit: https://github.com/danbudris/go/commit/778152173274e56bf43b18de3531ab59893552a2 Upstream Source Commit: https://github.com/golang/go/commit/76f8b7304d1f7c25834e2a0cc9e88c55276c47df # Original Information A limit is added to the number of path separators allowed by an input to Glob, to prevent stack exhaustion issues. Thanks to Juho Nurminen of Mattermost who reported the issue. Fixes #53713 Updates #53416 Fixes CVE-2022-30632 Change-Id: I1b9fd4faa85411a05dbc91dceae1c0c8eb021f07 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1498176 Reviewed-by: Roland Shoemaker (cherry picked from commit d182a6d1217fd0d04c9babfa9a7ccd3515435c39) Reviewed-on: https://go-review.googlesource.com/c/go/+/417073 Reviewed-by: Heschi Kreinick TryBot-Result: Gopher Robot Run-TryBot: Michael Knyszek --- src/path/filepath/match.go | 16 +++++++++++++++- src/path/filepath/match_test.go | 10 ++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/src/path/filepath/match.go b/src/path/filepath/match.go index 20a334805b..b6a3b450fe 100644 --- a/src/path/filepath/match.go +++ b/src/path/filepath/match.go @@ -232,6 +232,20 @@ func getEsc(chunk string) (r rune, nchunk string, err error) { // The only possible returned error is ErrBadPattern, when pattern // is malformed. func Glob(pattern string) (matches []string, err error) { + return globWithLimit(pattern, 0) +} + +func globWithLimit(pattern string, depth int) (matches []string, err error) { + // This limit is used prevent stack exhaustion issues. See CVE-2022-30632. + const pathSeparatorsLimit = 10000 + if depth == pathSeparatorsLimit { + return nil, ErrBadPattern + } + + // Check pattern is well-formed. + if _, err := Match(pattern, ""); err != nil { + return nil, err + } if !hasMeta(pattern) { if _, err = os.Lstat(pattern); err != nil { return nil, nil @@ -257,7 +271,7 @@ func Glob(pattern string) (matches []string, err error) { } var m []string - m, err = Glob(dir) + m, err = globWithLimit(dir, depth+1) if err != nil { return } diff --git a/src/path/filepath/match_test.go b/src/path/filepath/match_test.go index b8657626bc..c37c812181 100644 --- a/src/path/filepath/match_test.go +++ b/src/path/filepath/match_test.go @@ -154,6 +154,16 @@ func TestGlob(t *testing.T) { } } +func TestCVE202230632(t *testing.T) { + // Prior to CVE-2022-30632, this would cause a stack exhaustion given a + // large number of separators (more than 4,000,000). There is now a limit + // of 10,000. + _, err := Glob("/*" + strings.Repeat("/", 10001)) + if err != ErrBadPattern { + t.Fatalf("Glob returned err=%v, want ErrBadPattern", err) + } +} + func TestGlobError(t *testing.T) { _, err := Glob("[]") if err == nil { -- 2.30.1 (Apple Git-130)