golang 1.14.7，2020-8-6 发布

最新推荐文章于 2022-08-22 18:01:58 发布

wide288

最新推荐文章于 2022-08-22 18:01:58 发布

阅读量154

点赞数

分类专栏： Golang

本文链接：https://blog.csdn.net/wide288/article/details/107915191

版权

Golang 专栏收录该内容

194 篇文章 4 订阅

订阅专栏

是安全修改

encoding/binary: read at most MaxVarintLen64 bytes in ReadUvarint

This CL ensures that ReadUvarint consumes only a limited
amount of input (instead of an unbounded amount).

On some inputs, ReadUvarint could read an arbitrary number
of bytes before deciding to return an overflow error.
After this CL, ReadUvarint returns that same overflow
error sooner, after reading at most MaxVarintLen64 bytes.

Fix authored by Robert Griesemer and Filippo Valsorda.

Thanks to Diederik Loerakker, Jonny Rhea, Raúl Kripalani,
and Preston Van Loon for reporting this.

Fixes CVE-2020-16845

编码包有溢出问题。