Sebastiaan van Stijn
ff13dd39f3
On Windows, syscall.StartProcess and os/exec.Cmd did not properly
check for invalid environment variable values. A malicious
environment variable value could exploit this behavior to set a
value for a different environment variable. For example, the
environment variable string "A=B\x00C=D" set the variables "A=B" and
"C=D".
Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this
issue.
This is CVE-2022-41716 and Go issue https://go.dev/issue/56284.
This Go release also fixes https://github.com/golang/go/issues/56309, a
runtime bug which can cause random memory corruption when a goroutine
exits with runtime.LockOSThread() set. This fix is necessary to unblock
work to replace certain uses of pkg/reexec with unshared OS threads.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 85eee32f4c)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
24 lines
465 B
YAML
24 lines
465 B
YAML
version: "{build}"
|
|
|
|
clone_folder: c:\gopath\src\github.com\docker\cli
|
|
|
|
environment:
|
|
GOPATH: c:\gopath
|
|
GOVERSION: 1.19.3
|
|
DEPVERSION: v0.4.1
|
|
|
|
install:
|
|
- rmdir c:\go /s /q
|
|
- appveyor DownloadFile https://storage.googleapis.com/golang/go%GOVERSION%.windows-amd64.msi
|
|
- msiexec /i go%GOVERSION%.windows-amd64.msi /q
|
|
- go version
|
|
- go env
|
|
|
|
deploy: false
|
|
|
|
build_script:
|
|
- ps: .\scripts\make.ps1 -Binary
|
|
|
|
test_script:
|
|
- ps: .\scripts\make.ps1 -TestUnit
|