Join GitHub today
GitHub is home to over 36 million developers working together to host and review code, manage projects, and build software together.Sign up
time: out of memory on LoadLocation of /dev/urandom or other unbounded file #18985
Update: "Technically, it’s not if ZONEINFO points to /dev/urandom, it’s if that environment variable isn’t set (which is the default scenario), and the someone calls time.LoadLocation(“../../../../dev/urandom”) (which could happen if a user can provide it’s own timezone)."
I don't think the patch is sufficient, if something like ../../../../dev/tty is passed, the function will hang.
Overall, this is only an issue if an application let a user picks a timezone, without verifying it. But the description doesn't mention that the function will actually perform read operation in the filesystem, nor that the value should be checked for error.