!442 [Backport-24.03-LTS]fix CVE-2024-34158, optimize the names of the first two patch files

From: @fuowang 
Reviewed-by: @hcnbxx 
Signed-off-by: @hcnbxx

backport-0023-go-build-constraint-add-parsing-limits.patch

@@ -0,0 +1,198 @@
+From f22d73197635b23c13bb852e330e5339eefaf910 Mon Sep 17 00:00:00 2001
+From: Roland Shoemaker <bracewell@google.com>
+Date: Thu, 20 Jun 2024 10:45:30 -0700
+Subject: [PATCH] go/build/constraint: add parsing limits
+
+Limit the size of build constraints that we will parse. This prevents a
+number of stack exhaustions that can be hit when parsing overly complex
+constraints. The imposed limits are unlikely to ever be hit in real
+world usage.
+
+Fixes #69141
+Fixes CVE-2024-34158
+
+Edited-by: Wang Shuo <wangshuo@kylinos.cn>
+
+Change-Id: I38b614bf04caa36eefc6a4350d848588c4cef3c4
+Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1540
+Reviewed-by: Damien Neil <dneil@google.com>
+Reviewed-by: Russ Cox <rsc@google.com>
+Reviewed-on: https://go-review.googlesource.com/c/go/+/611240
+Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
+LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
+Reviewed-by: Roland Shoemaker <roland@golang.org>
+Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
+---
+ src/go/build/constraint/expr.go      | 28 ++++++++++--
+ src/go/build/constraint/expr_test.go | 65 +++++++++++++++++++++++++++-
+ 2 files changed, 89 insertions(+), 4 deletions(-)
+
+diff --git a/src/go/build/constraint/expr.go b/src/go/build/constraint/expr.go
+index 505cbff..c438a8a 100644
+--- a/src/go/build/constraint/expr.go
++++ b/src/go/build/constraint/expr.go
+@@ -16,6 +16,10 @@ import (
+ 	"unicode/utf8"
+ )
+ 
++// maxSize is a limit used to control the complexity of expressions, in order
++// to prevent stack exhaustion issues due to recursion.
++const maxSize = 1000
++
+ // An Expr is a build tag constraint expression.
+ // The underlying concrete type is *AndExpr, *OrExpr, *NotExpr, or *TagExpr.
+ type Expr interface {
+@@ -151,7 +155,7 @@ func Parse(line string) (Expr, error) {
+ 		return parseExpr(text)
+ 	}
+ 	if text, ok := splitPlusBuild(line); ok {
+-		return parsePlusBuildExpr(text), nil
++		return parsePlusBuildExpr(text)
+ 	}
+ 	return nil, errNotConstraint
+ }
+@@ -201,6 +205,8 @@ type exprParser struct {
+ 	tok   string // last token read
+ 	isTag bool
+ 	pos   int // position (start) of last token
++
++	size int
+ }
+ 
+ // parseExpr parses a boolean build tag expression.
+@@ -249,6 +255,10 @@ func (p *exprParser) and() Expr {
+ // On entry, the next input token has not yet been lexed.
+ // On exit, the next input token has been lexed and is in p.tok.
+ func (p *exprParser) not() Expr {
++	p.size++
++	if p.size > maxSize {
++		panic(&SyntaxError{Offset: p.pos, Err: "build expression too large"})
++	}
+ 	p.lex()
+ 	if p.tok == "!" {
+ 		p.lex()
+@@ -388,7 +398,13 @@ func splitPlusBuild(line string) (expr string, ok bool) {
+ }
+ 
+ // parsePlusBuildExpr parses a legacy build tag expression (as used with “// +build”).
+-func parsePlusBuildExpr(text string) Expr {
++func parsePlusBuildExpr(text string) (Expr, error) {
++	// Only allow up to 100 AND/OR operators for "old" syntax.
++	// This is much less than the limit for "new" syntax,
++	// but uses of old syntax were always very simple.
++	const maxOldSize = 100
++	size := 0
++
+ 	var x Expr
+ 	for _, clause := range strings.Fields(text) {
+ 		var y Expr
+@@ -414,19 +430,25 @@ func parsePlusBuildExpr(text string) Expr {
+ 			if y == nil {
+ 				y = z
+ 			} else {
++				if size++; size > maxOldSize {
++					return nil, errComplex
++				}
+ 				y = and(y, z)
+ 			}
+ 		}
+ 		if x == nil {
+ 			x = y
+ 		} else {
++			if size++; size > maxOldSize {
++				return nil, errComplex
++			}
+ 			x = or(x, y)
+ 		}
+ 	}
+ 	if x == nil {
+ 		x = tag("ignore")
+ 	}
+-	return x
++	return x, nil
+ }
+ 
+ // isValidTag reports whether the word is a valid build tag.
+diff --git a/src/go/build/constraint/expr_test.go b/src/go/build/constraint/expr_test.go
+index 15d1890..ac38ba6 100644
+--- a/src/go/build/constraint/expr_test.go
++++ b/src/go/build/constraint/expr_test.go
+@@ -222,7 +222,7 @@ var parsePlusBuildExprTests = []struct {
+ func TestParsePlusBuildExpr(t *testing.T) {
+ 	for i, tt := range parsePlusBuildExprTests {
+ 		t.Run(fmt.Sprint(i), func(t *testing.T) {
+-			x := parsePlusBuildExpr(tt.in)
++			x, _ := parsePlusBuildExpr(tt.in)
+ 			if x.String() != tt.x.String() {
+ 				t.Errorf("parsePlusBuildExpr(%q):\nhave %v\nwant %v", tt.in, x, tt.x)
+ 			}
+@@ -319,3 +319,66 @@ func TestPlusBuildLines(t *testing.T) {
+ 		})
+ 	}
+ }
++
++func TestSizeLimits(t *testing.T) {
++	for _, tc := range []struct {
++		name string
++		expr string
++	}{
++		{
++			name: "go:build or limit",
++			expr: "//go:build " + strings.Repeat("a || ", maxSize+2),
++		},
++		{
++			name: "go:build and limit",
++			expr: "//go:build " + strings.Repeat("a && ", maxSize+2),
++		},
++		{
++			name: "go:build and depth limit",
++			expr: "//go:build " + strings.Repeat("(a &&", maxSize+2),
++		},
++		{
++			name: "go:build or depth limit",
++			expr: "//go:build " + strings.Repeat("(a ||", maxSize+2),
++		},
++	} {
++		t.Run(tc.name, func(t *testing.T) {
++			_, err := Parse(tc.expr)
++			if err == nil {
++				t.Error("expression did not trigger limit")
++			} else if syntaxErr, ok := err.(*SyntaxError); !ok || syntaxErr.Err != "build expression too large" {
++				if !ok {
++					t.Errorf("unexpected error: %v", err)
++				} else {
++					t.Errorf("unexpected syntax error: %s", syntaxErr.Err)
++				}
++			}
++		})
++	}
++}
++
++func TestPlusSizeLimits(t *testing.T) {
++	maxOldSize := 100
++	for _, tc := range []struct {
++		name string
++		expr string
++	}{
++		{
++			name: "+build or limit",
++			expr: "// +build " + strings.Repeat("a ", maxOldSize+2),
++		},
++		{
++			name: "+build and limit",
++			expr: "// +build " + strings.Repeat("a,", maxOldSize+2),
++		},
++	} {
++		t.Run(tc.name, func(t *testing.T) {
++			_, err := Parse(tc.expr)
++			if err == nil {
++				t.Error("expression did not trigger limit")
++			} else if err != errComplex {
++				t.Errorf("unexpected error: got %q, want %q", err, errComplex)
++			}
++		})
++	}
++}
+-- 
+2.27.0
+

golang.spec

@@ -66,7 +66,7 @@
 
 Name:           golang
 Version:        1.21.4
-Release:        24
+Release:        25
 Summary:        The Go Programming Language
 License:        BSD and Public Domain
 URL:            https://golang.org/
@@ -141,8 +141,9 @@ Patch6017:	backport-0017-release-branch.go1.21-runtime-call-enableMetadataHug.pa
 Patch6018:	backport-0018-release-branch.go1.21-cmd-compile-fix-findIndVar-so-.patch
 Patch6019:	backport-0019-release-branch.go1.21-cmd-compile-fix-escape-analysi.patch
 Patch6020:	backport-0020-release-branch.go1.21-runtime-pprof-fix-generics-fun.patch
-Patch6021:	0124-CVE-2024-34155-track-depth-in-nested-element-lists.patch
+Patch6021:	backport-0021-CVE-2024-34155-track-depth-in-nested-element-lists.patch
-Patch6022:	backport-0021-release-branch.go1.21-fix-CVE-2024-34156.patch
+Patch6022:	backport-0022-release-branch.go1.21-fix-CVE-2024-34156.patch
+Patch6023:	backport-0023-go-build-constraint-add-parsing-limits.patch
 
 ExclusiveArch:  %{golang_arches}
 
@@ -381,6 +382,13 @@ fi
 %files devel -f go-tests.list -f go-misc.list -f go-src.list
 
 %changelog
+* Tue Nov 5 2024 wangshuo <wangshuo@kylinos.cn> - 1.21.4-25
+- Type:CVE
+- CVE:CVE-2024-34158
+- SUG:NA
+- DESC:fix CVE-2024-34158
+-      optimize the names of the first two patch files
+
 * Mon Nov 4 2024 changtao <changtao@kylinos.cn> - 1.21.4-24
 - fix CVE-2024-34156