Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vuln: remove unaffected symbols from json output in binary mode #59698

Closed
julieqiu opened this issue Apr 18, 2023 · 1 comment
Closed

x/vuln: remove unaffected symbols from json output in binary mode #59698

julieqiu opened this issue Apr 18, 2023 · 1 comment
Labels
FrozenDueToAge vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Milestone
vuln/v0.2.0

Comments

@julieqiu
Copy link
Member

For example, for GO-2021-0054, the callstacks shouldn't be present:

https://github.com/golang/vuln/blob/22f32fddd8a17e19dcc6bfc82d3d6f2863ce8748/cmd/govulncheck/testdata/binaryjson.ct#L285-L298

since this vulnerability is not called:

https://github.com/golang/vuln/blob/22f32fddd8a17e19dcc6bfc82d3d6f2863ce8748/cmd/govulncheck/testdata/source.ct#L45
@julieqiu julieqiu added the vulncheck or vulndb Issues for the x/vuln or x/vulndb repo label Apr 18, 2023
@julieqiu julieqiu added this to the vuln/v0.2.0 milestone Apr 18, 2023
@julieqiu
Copy link
Member Author

Discussed with @zpavlinovic - in binary mode, we cannot know with certainty which symbols are called, so all symbols present in the binary are present. Unused code can be pulled in by the linker for performance reasons, and there is no way for us to figure that the method is not used. Closing this issue.

@golang golang locked and limited conversation to collaborators Apr 17, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge vulncheck or vulndb Issues for the x/vuln or x/vulndb repo
Projects
None yet
Milestone
vuln/v0.2.0
Development

No branches or pull requests
2 participants
@julieqiu @gopherbot