Re: Go 1.25.6 and Go 1.24.12 are released with 6 CVE fixes

[Steffen Nurpmeso <steffen () sdaoden eu>]

Alan Coopersmith wrote in
 <01e3014e-85d8-484c-b755-bd8eb6ddd10d () oracle com>:
 |https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc announces:
 |> Hello gophers,
 |> 
 |> We have just released Go versions 1.25.6 and 1.24.12, minor point \
 |> releases.
 |> 
 |> These releases include 6 security fixes following the security policy:
 |> 
 |>   - archive/zip: denial of service when parsing arbitrary ZIP archives
 |> 
 |>     archive/zip used a super-linear file name indexing algorithm \
 |>     that is invoked
 |>     the first time a file in an archive is opened. This can lead \
 |>     to a denial of
 |>     service when consuming a maliciously constructed ZIP archive.
 |> 
 |>     Thanks to Thanks to Jakub Ciolek for reporting this issue.
 |> 
 |>     This is CVE-2025-61728 and Go issue https://go.dev/issue/77102.

Go is thrilling you know, those personalities involved in the past
and present (also including Plan9 history, and all that) ...

It is a little bit off-topic, but it reminds me of kinds of
"detoriation", as well as "spreaded complication" i have
introduced myself when fixing bugs of all sort.  So looking at the
link bug report, i see

  for dir := path.Dir(name); dir != "."; dir = path.Dir(dir) {

being replaced with an unrolled

  if idx := strings.LastIndex(dir, "/"); idx < 0 {
    ...

But Go supports "modification in place", and doesn't the above
imply that the Go standard library interface is missing important
functionality to avoid such security glitches in any code that
makes use of path.?  Ie, path.Dir() is

  Dir returns all but the last element of path, typically the
  path's directory. After dropping the final element using Split,
  the path is Cleaned and trailing slashes are removed. If the
  path is empty, Dir returns ".". If the path consists entirely of
  slashes followed by non-slash bytes, Dir returns a single
  slash. In any other case, the returned path does not end in
  a slash.

and path.Split() is

  Split splits path immediately following the final slash,
  separating it into a directory and file name component. If there
  is no slash in path, Split returns an empty dir and file set to
  path. The returned values have the property that path
  = dir+file.

And i note that the committed bugfix not only avoids all the
canonicalization cleanup of Dir(), but also the creation of new
(temporary) result strings.  In order to do that creates (yet
another?) place that fiddles with indices.

Just a (well-known, granted) thought in all the overdriven
"memory-safe" noise.

--steffen
|
|Der Kragenbaer,                The moon bear,
|der holt sich munter           he cheerfully and one by one
|einen nach dem anderen runter  wa.ks himself off
|(By Robert Gernhardt)