Skip to content

v1.18.1

Choose a tag to compare

View all tags
@jhump jhump released this 28 Aug 17:23
· 3 commits to v1 since this release
v1.18.1
dcd52d1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This point release addresses a potential issue identified here: GHSA-4qcm-mfjx-j36w

"github.com/jhump/protoreflect/grpcreflect"

Changes/fixes:

  • If a file to download has an import cycle, it is now detected, and an error is returned. This fixes an issue where such a set of files would previously induce infinite recursion and result in the calling program terminating with a "stack overflow" fatal error.
  • If a file does not have an import cycle but still has a pathologically deep import tree, that is also detected, and an error is returned. Such a set of files could be generated by a malicious server and result in the same "stack overflow" fatal error. The import depth is now limited to 1024, which should be signifcantly higher than import depths in any real code bases (so we don't trigger false positives), but also low enough that it won't result in a stack overflow.
Assets 2
Loading