commit 34c8b14ca9f4096383d658fbd748322a993a2bd2 [browse]
Author: Gopher Robot
Date: 2025-05-06 10:34:54 -07:00

[release-branch.go1.24] go1.24.3

Change-Id: I83acf5f2bda35ee81abbbb2fc6143fa6c8e342aa
Reviewed-on: https://go-review.googlesource.com/c/go/+/670456
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Gopher Robot <gobot@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Carlos Amedee <carlos@golang.org>

commit 8947f3395eb24dce6a5749517c0b40204b585f0a [browse]
Author: Damien Neil
Date: 2025-04-16 11:01:19 -07:00

[release-branch.go1.24] os: avoid escape from Root via paths ending in ../

The doInRoot function operates on a path split into components.
The final path component retained any trailing path separator
characters, to permit operations in a Root to retain the
trailing-separator behavior of non-Root operations. However,
doInRoot failed to take trailing separators into account
when checking for .. path components.

This could permit opening the parent directory of the Root
with a path ending in "../".

Change the split path to never include path separators in
components, and handle trailing separators independently
of the split path.

Thanks to Dan Sebastian Thrane of SDU eScience Center for
reporting this issue.

Fixes #73556
Updates #73555
Fixes CVE-2025-22873

Change-Id: I9a33a145c22f5eb1dd4e4cafae5fcc61a8d4f0d4
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2160
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2180
Commit-Queue: Damien Neil <dneil@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/670357
Reviewed-by: Carlos Amedee <carlos@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

commit 06fd2f115b98dfa7fc0f1a9d451d2538b23e40fb [browse]
Author: David Chase
Date: 2025-03-05 14:27:15 -05:00

[release-branch.go1.24] cmd/compile: remove no-longer-necessary recursive inlining checks

this does result in a little bit more inlining,
cmd/compile text is 0.5% larger,
bent-benchmark text geomeans grow by only 0.02%.
some of our tests make assumptions about inlining.

Fixes: #73440.

Change-Id: I999d1798aca5dc64a1928bd434258a61e702951a
Reviewed-on: https://go-review.googlesource.com/c/go/+/655157
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Keith Randall <khr@google.com>
Reviewed-by: Cuong Manh Le <cuong.manhle.vn@gmail.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/666555
Reviewed-by: Keith Randall <khr@golang.org>
Reviewed-by: Carlos Amedee <carlos@golang.org>

commit f66ab6521cae4113acd5e80683aeed2e8430cf50 [browse]
Author: Zxilly
Date: 2025-04-09 12:17:21 Z

[release-branch.go1.24] cmd/internal/obj/wasm: use i64 for large return addr

Use i64 to avoid overflow when getting PC_F from the return addr.

For #73246.
Fixes #73281.

Change-Id: I5683dccf7eada4b8536edf53e2e83116a2f6d943
GitHub-Last-Rev: 267d9a1a031868430d0af530de14229ee1ae8609
GitHub-Pull-Request: golang/go#73277
Reviewed-on: https://go-review.googlesource.com/c/go/+/663995
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>
(cherry picked from commit d60a684c87104ed7836403eab74eb2be1e4a97cb)
Reviewed-on: https://go-review.googlesource.com/c/go/+/668615
Reviewed-by: Carlos Amedee <carlos@golang.org>

commit c1f9c2c7b0a3922a4dc90e31bffd7d3425328694 [browse]
Author: Dimitri John Ledkov
Date: 2022-07-19 11:07:00 -04:00

[release-branch.go1.24] cmd/go/internal/load: join incompatible and dirty build specifiers with .

Change "+incompatible+dirty" version to be "+incompatible.dirty" such
that it is SemVer spec compatible.

Fixes #73500

Change-Id: I714ffb3f1ad88c793656c3652367db34739a2144
Reviewed-on: https://go-review.googlesource.com/c/go/+/652955
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Sam Thanawalla <samthanawalla@google.com>
Reviewed-by: Sean Liao <sean@liao.dev>
Auto-Submit: Sean Liao <sean@liao.dev>
Reviewed-by: Michael Matloob <matloob@golang.org>
(cherry picked from commit a6e74454577c68ea96ce6512e3e92beffbe15c5c)
Reviewed-on: https://go-review.googlesource.com/c/go/+/668135