Skip to content

Commit b191009

Browse files
thatnealpatelgopherbot
authored andcommitted
[release-branch.go1.25] cmd/go: remove user-content from doc strings in cgo ASTs.
Thank you to RyotaK (https://ryotak.net) of GMO Flatt Security Inc. for reporting this issue. Updates #76697 Fixes #77129 Fixes CVE-2025-61732 Change-Id: I9ecbef556f6e545fb152407041cd086c069f22d1 Reviewed-on: https://go-review.googlesource.com/c/go/+/740040 Auto-Submit: Dmitri Shuralyov <dmitshur@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
1 parent 738bc3a commit b191009

File tree

1 file changed

+3
-8
lines changed

1 file changed

+3
-8
lines changed

src/cmd/cgo/ast.go

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -301,17 +301,12 @@ func (f *File) saveExport(x interface{}, context astContext) {
301301
error_(c.Pos(), "export comment has wrong name %q, want %q", name, n.Name.Name)
302302
}
303303

304-
doc := ""
305-
for _, c1 := range n.Doc.List {
306-
if c1 != c {
307-
doc += c1.Text + "\n"
308-
}
309-
}
310-
311304
f.ExpFunc = append(f.ExpFunc, &ExpFunc{
312305
Func: n,
313306
ExpName: name,
314-
Doc: doc,
307+
// Caution: Do not set the Doc field on purpose
308+
// to ensure that there are no unintended artifacts
309+
// in the binary. See https://go.dev/issue/76697.
315310
})
316311
break
317312
}

0 commit comments

Comments
 (0)