From c41caa28e534895bbc8e236e9e0dcdf718b1246f Mon Sep 17 00:00:00 2001
From: Merlin <merlinsun@hust.edu.cn>
Date: Thu, 27 Apr 2023 15:04:01 +0800
Subject: [PATCH] fix infinite loop in parsing

---
 fix-CVE-2023-24537.patch | 69 ++++++++++++++++++++++++++++++++++++++++
 skopeo.spec              |  6 ++++
 2 files changed, 75 insertions(+)
 create mode 100644 fix-CVE-2023-24537.patch

diff --git a/fix-CVE-2023-24537.patch b/fix-CVE-2023-24537.patch
new file mode 100644
index 0000000..6fa652b
--- /dev/null
+++ b/fix-CVE-2023-24537.patch
@@ -0,0 +1,69 @@
+From 02f8f73194c075abdebb58d4c41891d400c1c3a0 Mon Sep 17 00:00:00 2001
+From: Merlin <merlinsun@hust.edu.cn>
+Date: Thu, 27 Apr 2023 11:10:22 +0800
+Subject: [PATCH] fix-CVE-2023-24537
+
+---
+ src/go/parser/parser_test.go | 16 ++++++++++++++++
+ src/go/scanner/scanner.go    |  7 +++++--
+ 2 files changed, 21 insertions(+), 2 deletions(-)
+
+diff --git a/src/go/parser/parser_test.go b/src/go/parser/parser_test.go
+index 153562df75..bf475d690b 100644
+--- a/src/go/parser/parser_test.go
++++ b/src/go/parser/parser_test.go
+@@ -764,3 +764,19 @@ func TestRangePos(t *testing.T) {
+ 		})
+ 	}
+ }
++
++// TestIssue59180 tests that line number overflow doesn't cause an infinite loop.
++func TestIssue59180(t *testing.T) {
++	testcases := []string{
++		"package p\n//line :9223372036854775806\n\n//",
++		"package p\n//line :1:9223372036854775806\n\n//",
++		"package p\n//line file:9223372036854775806\n\n//",
++	}
++
++	for _, src := range testcases {
++		_, err := ParseFile(token.NewFileSet(), "", src, ParseComments)
++		if err == nil {
++			t.Errorf("ParseFile(%s) succeeded unexpectedly", src)
++		}
++	}
++}
+\ No newline at end of file
+diff --git a/src/go/scanner/scanner.go b/src/go/scanner/scanner.go
+index 16958d22ce..0cd9f5901d 100644
+--- a/src/go/scanner/scanner.go
++++ b/src/go/scanner/scanner.go
+@@ -253,13 +253,16 @@ func (s *Scanner) updateLineInfo(next, offs int, text []byte) {
+ 		return
+ 	}
+ 
++	// Put a cap on the maximum size of line and column numbers.
++	// 30 bits allows for some additional space before wrapping an int32.
++	const maxLineCol = 1<<30 - 1
+ 	var line, col int
+ 	i2, n2, ok2 := trailingDigits(text[:i-1])
+ 	if ok2 {
+ 		//line filename:line:col
+ 		i, i2 = i2, i
+ 		line, col = n2, n
+-		if col == 0 {
++		if col == 0 || col > maxLineCol {
+ 			s.error(offs+i2, "invalid column number: "+string(text[i2:]))
+ 			return
+ 		}
+@@ -269,7 +272,7 @@ func (s *Scanner) updateLineInfo(next, offs int, text []byte) {
+ 		line = n
+ 	}
+ 
+-	if line == 0 {
++	if line == 0 || line > maxLineCol {
+ 		s.error(offs+i, "invalid line number: "+string(text[i:]))
+ 		return
+ 	}
+-- 
+2.37.1 (Apple Git-137.1)
+
diff --git a/skopeo.spec b/skopeo.spec
index db0adc3..39927bc 100644
--- a/skopeo.spec
+++ b/skopeo.spec
@@ -319,6 +319,12 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
 %{_prefix}/share/bash-completion/completions/%{name}
 
 %changelog
+* Thu Apr  27 2023 Merlin <merlinsun@hust.edu.cn> - 1:1.8.0-2
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:Fix infinite loop in parsing
+
 * Mon Nov 07 2022 fushanqing <fushanqing@kylinos.cn> - 1:1.8.0-1
 - update to 1.8.0.