Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

maps: segmentation violation in maps.Clone [1.23 backport] #69156

Closed
gopherbot opened this issue Aug 29, 2024 · 2 comments
Closed

maps: segmentation violation in maps.Clone [1.23 backport] #69156

gopherbot opened this issue Aug 29, 2024 · 2 comments
Labels
CherryPickApproved Used during the release process for point releases
Milestone

Comments

@gopherbot
Copy link
Contributor

@randall77 requested issue #69110 to be considered for backport to the next 1.23 minor release.

@gopherbot Please open backport issues.
This is a rare memory corruption bug in maps.Clone.

@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label Aug 29, 2024
@gopherbot gopherbot added this to the Go1.23.1 milestone Aug 29, 2024
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/610377 mentions this issue: [release-branch.go1.23] runtime: size maps.Clone destination bucket array safely

@dmitshur dmitshur added CherryPickApproved Used during the release process for point releases and removed CherryPickCandidate Used during the release process for point releases labels Sep 4, 2024
@gopherbot gopherbot modified the milestones: Go1.23.1, Go1.23.2 Sep 5, 2024
gopherbot pushed a commit that referenced this issue Sep 6, 2024

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
…rray safely

In rare situations, like during same-sized grows, the source map for
maps.Clone may be overloaded (has more than 6.5 entries per
bucket). This causes the runtime to allocate a larger bucket array for
the destination map than for the source map. The maps.Clone code
walks off the end of the source array if it is smaller than the
destination array.

This is a pretty simple fix, ensuring that the destination bucket
array is never longer than the source bucket array. Maybe a better fix
is to make the Clone code handle shorter source arrays correctly, but
this fix is deliberately simple to reduce the risk of backporting this
fix.

Fixes #69156

Change-Id: I824c93d1db690999f25a3c43b2816fc28ace7509
Reviewed-on: https://go-review.googlesource.com/c/go/+/610377
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Cuong Manh Le <cuong.manhle.vn@gmail.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
Reviewed-by: Keith Randall <khr@google.com>
@gopherbot
Copy link
Contributor Author

Closed by merging CL 610377 (commit a886959) to release-branch.go1.23.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CherryPickApproved Used during the release process for point releases
Projects
None yet
Development

No branches or pull requests

2 participants