[go/release-branch.go1.27] [release-branch.go1.27] encoding/xml: fix depth processing in (*Decoder).unmarshal

1 view
Skip to first unread message

Gopher Robot (Gerrit)

unread,
Jul 29, 2026, 7:41:31 PM (11 days ago) Jul 29
to Ian Alexander, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, golang...@luci-project-accounts.iam.gserviceaccount.com, Dmitri Shuralyov, Dmitri Shuralyov, Russ Cox, golang-co...@googlegroups.com

Gopher Robot submitted the change

Change information

Commit message:
[release-branch.go1.27] encoding/xml: fix depth processing in (*Decoder).unmarshal

(*Decoder).DecodeElement bypassed recursion depth guard by unilaterally
passing the constant 0 to (*Decoder).unmarshal. Previously, unmarshal
depth was tracked via a depth parameter passed down the call stack,
which manual loops inside custom UnmarshalXML methods could bypass.

This change simplifies depth tracking by maintaining a stack depth value
that is adjusted as start elements are pushed / popped. This eliminates
the need to reason about and synchronize two different values storing
the unmarshal depth.

Additionally, guarding (*Decoder).RawToken using parser stack state
broke streaming decoders reading tokens within open XML elements. This
change simplifies the guard by adding an explicit inUnmarshalXML flag.

Thanks to Moran Omer (GitHub: moraneus) for reporting this issue.

Updates #80481
Fixes CVE-2026-56859

Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Reviewed-on: https://go-review.googlesource.com/c/go/+/803320
Reviewed-by: Roland Shoemaker <rol...@golang.org>
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit ccb0514cb7ff74c1104579f7945a806630dac73e)
Reviewed-on: https://go-review.googlesource.com/c/go/+/807680
Auto-Submit: Ian Alexander <ji...@google.com>
Reviewed-by: Dmitri Shuralyov <dmit...@google.com>
Reviewed-by: Dmitri Shuralyov <dmit...@golang.org>
Files:
  • M src/encoding/xml/read.go
  • M src/encoding/xml/read_test.go
  • M src/encoding/xml/xml.go
Change size: M
Delta: 3 files changed, 176 insertions(+), 17 deletions(-)
Branch: refs/heads/release-branch.go1.27
Submit Requirements:
Open in Gerrit
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: merged
Gerrit-Project: go
Gerrit-Branch: release-branch.go1.27
Gerrit-Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Gerrit-Change-Number: 807680
Gerrit-PatchSet: 2
Gerrit-Owner: Ian Alexander <ji...@google.com>
Gerrit-Reviewer: Dmitri Shuralyov <dmit...@golang.org>
Gerrit-Reviewer: Dmitri Shuralyov <dmit...@google.com>
Gerrit-Reviewer: Gopher Robot <go...@golang.org>
Gerrit-Reviewer: Ian Alexander <ji...@google.com>
Gerrit-Reviewer: Russ Cox <r...@golang.org>
open
diffy
satisfied_requirement

Mark Freeman (Gerrit)

unread,
Aug 5, 2026, 5:23:10 PM (5 days ago) Aug 5
to Ian Alexander, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, golang...@luci-project-accounts.iam.gserviceaccount.com, Cherry Mui, Dmitri Shuralyov, Roland Shoemaker, golang-co...@googlegroups.com

Mark Freeman submitted the change

Change information

Commit message:
[release-branch.go1.25] encoding/xml: fix depth processing in (*Decoder).unmarshal


(*Decoder).DecodeElement bypassed recursion depth guard by unilaterally
passing the constant 0 to (*Decoder).unmarshal. Previously, unmarshal
depth was tracked via a depth parameter passed down the call stack,
which manual loops inside custom UnmarshalXML methods could bypass.

This change simplifies depth tracking by maintaining a stack depth value
that is adjusted as start elements are pushed / popped. This eliminates
the need to reason about and synchronize two different values storing
the unmarshal depth.

Additionally, guarding (*Decoder).RawToken using parser stack state
broke streaming decoders reading tokens within open XML elements. This
change simplifies the guard by adding an explicit inUnmarshalXML flag.

Thanks to Moran Omer (GitHub: moraneus) for reporting this issue.

Updates #80481
Fixes #80627

Fixes CVE-2026-56859

Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Reviewed-on: https://go-review.googlesource.com/c/go/+/803320
Reviewed-by: Roland Shoemaker <rol...@golang.org>
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit ccb0514cb7ff74c1104579f7945a806630dac73e)
Files:
  • M src/encoding/xml/read.go
  • M src/encoding/xml/read_test.go
  • M src/encoding/xml/xml.go
Change size: M
Delta: 3 files changed, 176 insertions(+), 17 deletions(-)
Branch: refs/heads/release-branch.go1.25
Submit Requirements:
  • requirement satisfiedCode-Review: +2 by Roland Shoemaker
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: merged
Gerrit-Project: go
Gerrit-Branch: release-branch.go1.25
Gerrit-Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Gerrit-Change-Number: 807520
Gerrit-PatchSet: 3
Gerrit-Owner: Ian Alexander <ji...@google.com>
Gerrit-Reviewer: Cherry Mui <cher...@google.com>
Gerrit-Reviewer: Mark Freeman <markf...@google.com>
Gerrit-Reviewer: Roland Shoemaker <rol...@golang.org>
Gerrit-CC: Dmitri Shuralyov <dmit...@golang.org>
open
diffy
satisfied_requirement

Mark Freeman (Gerrit)

unread,
Aug 5, 2026, 5:23:15 PM (5 days ago) Aug 5
to Ian Alexander, goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Dmitri Shuralyov, golang...@luci-project-accounts.iam.gserviceaccount.com, Cherry Mui, Roland Shoemaker, golang-co...@googlegroups.com

Mark Freeman submitted the change

Change information

Commit message:
[release-branch.go1.26] encoding/xml: fix depth processing in (*Decoder).unmarshal


(*Decoder).DecodeElement bypassed recursion depth guard by unilaterally
passing the constant 0 to (*Decoder).unmarshal. Previously, unmarshal
depth was tracked via a depth parameter passed down the call stack,
which manual loops inside custom UnmarshalXML methods could bypass.

This change simplifies depth tracking by maintaining a stack depth value
that is adjusted as start elements are pushed / popped. This eliminates
the need to reason about and synchronize two different values storing
the unmarshal depth.

Additionally, guarding (*Decoder).RawToken using parser stack state
broke streaming decoders reading tokens within open XML elements. This
change simplifies the guard by adding an explicit inUnmarshalXML flag.

Thanks to Moran Omer (GitHub: moraneus) for reporting this issue.

Updates #80481
Fixes #80628

Fixes CVE-2026-56859

Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Reviewed-on: https://go-review.googlesource.com/c/go/+/803320
Reviewed-by: Roland Shoemaker <rol...@golang.org>
LUCI-TryBot-Result: golang...@luci-project-accounts.iam.gserviceaccount.com <golang...@luci-project-accounts.iam.gserviceaccount.com>
(cherry picked from commit ccb0514cb7ff74c1104579f7945a806630dac73e)
Files:
  • M src/encoding/xml/read.go
  • M src/encoding/xml/read_test.go
  • M src/encoding/xml/xml.go
Change size: M
Delta: 3 files changed, 176 insertions(+), 17 deletions(-)
Branch: refs/heads/release-branch.go1.26
Submit Requirements:
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: merged
Gerrit-Project: go
Gerrit-Branch: release-branch.go1.26
Gerrit-Change-Id: I5e89ebe9101b03545520aba5ea99fbf15bdf0395
Gerrit-Change-Number: 807540
Gerrit-PatchSet: 2
Gerrit-Owner: Ian Alexander <ji...@google.com>
Gerrit-Reviewer: Cherry Mui <cher...@google.com>
Gerrit-Reviewer: Dmitri Shuralyov <dmit...@golang.org>
open
diffy
satisfied_requirement
Reply all
Reply to author
Forward
0 new messages