Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

strings: Builder ReadFrom permits creation of mutable strings #23083

Closed
fweimer opened this issue Dec 11, 2017 · 3 comments
Closed

strings: Builder ReadFrom permits creation of mutable strings #23083

fweimer opened this issue Dec 11, 2017 · 3 comments
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. release-blocker
Milestone

Comments

@fweimer
Copy link
Contributor

fweimer commented Dec 11, 2017

This program allows the creation of mutable strings:

package main

import (
        "fmt"
        "io"
        "strings"
)

var global_buf []byte

type Reader struct{}

func (Reader) Read(buf []byte) (count int, err error) {
        global_buf = buf
        return 0, io.EOF
}

func main() {
        var b strings.Builder
        b.ReadFrom(Reader{})
        fmt.Printf("len(global_buf): %d\n", len(global_buf))
        b.WriteString("foo")
        s := b.String()
        fmt.Printf("string before patching: %#v\n", s)
        copy(global_buf[:3], "bar")
        fmt.Printf("string after patching: %#v\n", s)
}

Output is:

len(global_buf): 512
string before patching: "foo"
string after patching: "bar"

The reason why this works is that the io.Reader Read method is passed a slice which refers to the internal buffer of the builder.

@fweimer
Copy link
Contributor Author

fweimer commented Dec 11, 2017

Issue #23084 is a different bug resulting in mutable strings.

@bradfitz
Copy link
Contributor

Also bad. Thanks for the reports! Will fix.

@gopherbot
Copy link

Change https://golang.org/cl/83255 mentions this issue: strings: fix two Builder bugs allowing mutation of strings, remove ReadFrom

@dsnet dsnet added release-blocker NeedsFix The path to resolution is known, but the work has not been done. labels Dec 11, 2017
@dsnet dsnet added this to the Go1.10 milestone Dec 11, 2017
@golang golang locked and limited conversation to collaborators Dec 11, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
FrozenDueToAge NeedsFix The path to resolution is known, but the work has not been done. release-blocker
Projects
None yet
Development

No branches or pull requests

4 participants