[go] net/mail: fix quadratic consumePhrase behavior

0 views
Skip to first unread message

Neal Patel (Gerrit)

unread,
Apr 28, 2026, 12:11:46 PM (17 hours ago) Apr 28
to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com

Neal Patel has uploaded the change for review

Commit message

net/mail: fix quadratic consumePhrase behavior

Fixes #78987
Fixes CVE-2026-42499
Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f

Change diff

diff --git a/src/net/mail/message.go b/src/net/mail/message.go
index fbf1fca..7282832 100644
--- a/src/net/mail/message.go
+++ b/src/net/mail/message.go
@@ -575,8 +575,11 @@
 func (p *addrParser) consumePhrase() (phrase string, err error) {
 	debug.Printf("consumePhrase: [%s]", p.s)
 	// phrase = 1*word
-	var words []string
-	var isPrevEncoded bool
+	var (
+		words         []string
+		isPrevEncoded bool
+		sb            strings.Builder
+	)
 	for {
 		// obs-phrase allows CFWS after one word
 		if len(words) > 0 {
@@ -608,13 +611,25 @@
 			break
 		}
 		debug.Printf("consumePhrase: consumed %q", word)
-		if isPrevEncoded && isEncoded {
-			words[len(words)-1] += word
-		} else {
-			words = append(words, word)
+		switch {
+		case isPrevEncoded && isEncoded:
+			sb.WriteString(word)
+			isPrevEncoded = isEncoded
+			continue
+		case isPrevEncoded && sb.Len() > 0:
+			words[len(words)-1] = sb.String()
+			sb.Reset()
+		case isEncoded:
+			sb.WriteString(word)
 		}
+		words = append(words, word)
 		isPrevEncoded = isEncoded
 	}
+
+	if sb.Len() > 0 {
+		words[len(words)-1] = sb.String()
+	}
+
 	// Ignore any error if we got at least one word.
 	if err != nil && len(words) == 0 {
 		debug.Printf("consumePhrase: hit err: %v", err)
diff --git a/src/net/mail/message_test.go b/src/net/mail/message_test.go
index 3393b03..80a4b2d 100644
--- a/src/net/mail/message_test.go
+++ b/src/net/mail/message_test.go
@@ -1262,6 +1262,17 @@
 	}
 }
 
+func BenchmarkConsumePhrase(b *testing.B) {
+	for _, n := range []int{10, 100, 1000, 10000} {
+		b.Run(fmt.Sprintf("words-%d", n), func(b *testing.B) {
+			input := strings.Repeat("=?utf-8?q?hello?= ", n) + "<us...@example.com>"
+			for b.Loop() {
+				(&addrParser{s: input}).consumePhrase()
+			}
+		})
+	}
+}
+
 func BenchmarkConsumeComment(b *testing.B) {
 	for _, n := range []int{10, 100, 1000, 10000} {
 		b.Run(fmt.Sprintf("depth-%d", n), func(b *testing.B) {

Change information

Files:
  • M src/net/mail/message.go
  • M src/net/mail/message_test.go
Change size: S
Delta: 2 files changed, 32 insertions(+), 6 deletions(-)
Open in Gerrit

Related details

Attention set is empty
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: newchange
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
Gerrit-Change-Number: 771520
Gerrit-PatchSet: 1
Gerrit-Owner: Neal Patel <neal...@google.com>
unsatisfied_requirement
satisfied_requirement
open
diffy

Neal Patel (Gerrit)

unread,
Apr 28, 2026, 12:12:02 PM (17 hours ago) Apr 28
to goph...@pubsubhelper.golang.org, Nicholas Husin, Roland Shoemaker, golang-co...@googlegroups.com
Attention needed from Nicholas Husin

Neal Patel voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Nicholas Husin
Submit Requirements:
  • requirement is not satisfiedCode-Review
  • requirement satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement is not satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
Gerrit-Change-Number: 771520
Gerrit-PatchSet: 1
Gerrit-Owner: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Nicholas Husin <n...@golang.org>
Gerrit-CC: Roland Shoemaker <rol...@golang.org>
Gerrit-Attention: Nicholas Husin <n...@golang.org>
Gerrit-Comment-Date: Tue, 28 Apr 2026 16:11:58 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
unsatisfied_requirement
satisfied_requirement
open
diffy

Nicholas Husin (Gerrit)

unread,
Apr 28, 2026, 2:22:02 PM (15 hours ago) Apr 28
to Neal Patel, goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Roland Shoemaker, golang-co...@googlegroups.com
Attention needed from Neal Patel

Nicholas Husin voted and added 1 comment

Votes added by Nicholas Husin

Code-Review+2

1 comment

File src/net/mail/message.go
Line 617, Patchset 1 (Latest): isPrevEncoded = isEncoded
Nicholas Husin . unresolved

`isPrevEncoded = isEncoded` would be a no-op here since `case isPrevEncoded && isEncoded`.

How about the following?

```
                switch {
                case isEncoded:
                        sb.WriteString(word)
                case !isEncoded && sb.Len() > 0:
                        words = append(words, sb.String())
                        sb.Reset()
                        words = append(words, word)
                default:
                        words = append(words, word)
                }
```

And down below:

```
        if sb.Len() > 0 {
                words = append(words, sb.String())                                  
        }
```
Open in Gerrit

Related details

Attention is currently required from:
  • Neal Patel
Submit Requirements:
  • requirement satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
  • requirement satisfiedTryBots-Pass
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: go
Gerrit-Branch: master
Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
Gerrit-Change-Number: 771520
Gerrit-PatchSet: 1
Gerrit-Owner: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Neal Patel <neal...@google.com>
Gerrit-Reviewer: Nicholas Husin <n...@golang.org>
Gerrit-CC: Roland Shoemaker <rol...@golang.org>
Gerrit-Attention: Neal Patel <neal...@google.com>
Gerrit-Comment-Date: Tue, 28 Apr 2026 18:21:58 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Nicholas Husin (Gerrit)

unread,
Apr 28, 2026, 2:22:10 PM (15 hours ago) Apr 28
to Neal Patel, goph...@pubsubhelper.golang.org, Nicholas Husin, golang...@luci-project-accounts.iam.gserviceaccount.com, Roland Shoemaker, golang-co...@googlegroups.com
Attention needed from Neal Patel

Nicholas Husin voted Code-Review+1

Code-Review+1
Open in Gerrit

Related details

Attention is currently required from:
  • Neal Patel
Submit Requirements:
    • requirement satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    • requirement satisfiedTryBots-Pass
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: go
    Gerrit-Branch: master
    Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
    Gerrit-Change-Number: 771520
    Gerrit-PatchSet: 1
    Gerrit-Owner: Neal Patel <neal...@google.com>
    Gerrit-Reviewer: Neal Patel <neal...@google.com>
    Gerrit-Reviewer: Nicholas Husin <hu...@google.com>
    Gerrit-Reviewer: Nicholas Husin <n...@golang.org>
    Gerrit-CC: Roland Shoemaker <rol...@golang.org>
    Gerrit-Attention: Neal Patel <neal...@google.com>
    Gerrit-Comment-Date: Tue, 28 Apr 2026 18:22:06 +0000
    Gerrit-HasComments: No
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Neal Patel (Gerrit)

    unread,
    Apr 28, 2026, 3:06:37 PM (14 hours ago) Apr 28
    to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
    Attention needed from Neal Patel

    Neal Patel uploaded new patchset

    Neal Patel uploaded patch set #2 to this change.
    Following approvals got outdated and were removed:
    Open in Gerrit

    Related details

    Attention is currently required from:
    • Neal Patel
    Submit Requirements:
      • requirement satisfiedCode-Review
      • requirement is not satisfiedNo-Unresolved-Comments
      • requirement satisfiedReview-Enforcement
      • requirement is not satisfiedTryBots-Pass
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: newpatchset
      Gerrit-Project: go
      Gerrit-Branch: master
      Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
      Gerrit-Change-Number: 771520
      Gerrit-PatchSet: 2
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Neal Patel (Gerrit)

      unread,
      Apr 28, 2026, 3:06:38 PM (14 hours ago) Apr 28
      to goph...@pubsubhelper.golang.org, Nicholas Husin, Nicholas Husin, golang...@luci-project-accounts.iam.gserviceaccount.com, Roland Shoemaker, golang-co...@googlegroups.com

      Neal Patel voted and added 1 comment

      Votes added by Neal Patel

      Commit-Queue+1

      1 comment

      File src/net/mail/message.go
      Line 617, Patchset 1: isPrevEncoded = isEncoded
      Nicholas Husin . resolved

      `isPrevEncoded = isEncoded` would be a no-op here since `case isPrevEncoded && isEncoded`.

      How about the following?

      ```
                      switch {
                      case isEncoded:
                              sb.WriteString(word)
                      case !isEncoded && sb.Len() > 0:
                              words = append(words, sb.String())
                              sb.Reset()
                              words = append(words, word)
                      default:
                              words = append(words, word)
                      }
      ```

      And down below:

      ```
              if sb.Len() > 0 {
                      words = append(words, sb.String())                                  
              }
      ```
      Neal Patel

      Done

      Open in Gerrit

      Related details

      Attention set is empty
      Submit Requirements:
      • requirement satisfiedCode-Review
      • requirement satisfiedNo-Unresolved-Comments
      • requirement satisfiedReview-Enforcement
      • requirement is not satisfiedTryBots-Pass
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: go
      Gerrit-Branch: master
      Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
      Gerrit-Change-Number: 771520
      Gerrit-PatchSet: 1
      Gerrit-Owner: Neal Patel <neal...@google.com>
      Gerrit-Reviewer: Neal Patel <neal...@google.com>
      Gerrit-Reviewer: Nicholas Husin <hu...@google.com>
      Gerrit-Reviewer: Nicholas Husin <n...@golang.org>
      Gerrit-CC: Roland Shoemaker <rol...@golang.org>
      Gerrit-Comment-Date: Tue, 28 Apr 2026 19:06:35 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: Yes
      Comment-In-Reply-To: Nicholas Husin <n...@golang.org>
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Neal Patel (Gerrit)

      unread,
      Apr 28, 2026, 3:06:48 PM (14 hours ago) Apr 28
      to goph...@pubsubhelper.golang.org, Nicholas Husin, Nicholas Husin, golang...@luci-project-accounts.iam.gserviceaccount.com, Roland Shoemaker, golang-co...@googlegroups.com

      Neal Patel voted Commit-Queue+1

      Commit-Queue+1
      Open in Gerrit

      Related details

      Attention set is empty
      Submit Requirements:
      • requirement satisfiedCode-Review
      • requirement satisfiedNo-Unresolved-Comments
      • requirement satisfiedReview-Enforcement
      • requirement is not satisfiedTryBots-Pass
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: go
      Gerrit-Branch: master
      Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
      Gerrit-Change-Number: 771520
      Gerrit-PatchSet: 2
      Gerrit-Owner: Neal Patel <neal...@google.com>
      Gerrit-Reviewer: Neal Patel <neal...@google.com>
      Gerrit-Reviewer: Nicholas Husin <hu...@google.com>
      Gerrit-Reviewer: Nicholas Husin <n...@golang.org>
      Gerrit-CC: Roland Shoemaker <rol...@golang.org>
      Gerrit-Comment-Date: Tue, 28 Apr 2026 19:06:44 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Nicholas Husin (Gerrit)

      unread,
      Apr 28, 2026, 3:34:14 PM (14 hours ago) Apr 28
      to Neal Patel, goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Nicholas Husin, Roland Shoemaker, golang-co...@googlegroups.com
      Attention needed from Neal Patel

      Nicholas Husin voted

      Code-Review+2
      Commit-Queue+1
      Open in Gerrit

      Related details

      Attention is currently required from:
      • Neal Patel
      Submit Requirements:
      • requirement satisfiedCode-Review
      • requirement satisfiedNo-Unresolved-Comments
      • requirement satisfiedReview-Enforcement
      • requirement is not satisfiedTryBots-Pass
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: go
      Gerrit-Branch: master
      Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
      Gerrit-Change-Number: 771520
      Gerrit-PatchSet: 2
      Gerrit-Owner: Neal Patel <neal...@google.com>
      Gerrit-Reviewer: Neal Patel <neal...@google.com>
      Gerrit-Reviewer: Nicholas Husin <hu...@google.com>
      Gerrit-Reviewer: Nicholas Husin <n...@golang.org>
      Gerrit-CC: Roland Shoemaker <rol...@golang.org>
      Gerrit-Attention: Neal Patel <neal...@google.com>
      Gerrit-Comment-Date: Tue, 28 Apr 2026 19:34:09 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Nicholas Husin (Gerrit)

      unread,
      Apr 28, 2026, 3:49:36 PM (13 hours ago) Apr 28
      to Neal Patel, goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Nicholas Husin, Roland Shoemaker, golang-co...@googlegroups.com
      Attention needed from Neal Patel

      Nicholas Husin voted Commit-Queue+1

      Gerrit-Comment-Date: Tue, 28 Apr 2026 19:49:33 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Nicholas Husin (Gerrit)

      unread,
      Apr 28, 2026, 4:16:18 PM (13 hours ago) Apr 28
      to Neal Patel, goph...@pubsubhelper.golang.org, golang...@luci-project-accounts.iam.gserviceaccount.com, Nicholas Husin, Roland Shoemaker, golang-co...@googlegroups.com
      Gerrit-Comment-Date: Tue, 28 Apr 2026 20:16:15 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      unsatisfied_requirement
      open
      diffy

      Neal Patel (Gerrit)

      unread,
      Apr 28, 2026, 4:37:03 PM (13 hours ago) Apr 28
      to goph...@pubsubhelper.golang.org, golang-co...@googlegroups.com
      Attention needed from Neal Patel

      Neal Patel uploaded new patchset

      Neal Patel uploaded patch set #3 to this change.
      Open in Gerrit

      Related details

      Attention is currently required from:
      • Neal Patel
      Submit Requirements:
        • requirement satisfiedCode-Review
        • requirement satisfiedNo-Unresolved-Comments
        • requirement satisfiedReview-Enforcement
        • requirement satisfiedTryBots-Pass
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        Gerrit-MessageType: newpatchset
        Gerrit-Project: go
        Gerrit-Branch: master
        Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
        Gerrit-Change-Number: 771520
        Gerrit-PatchSet: 3
        satisfied_requirement
        open
        diffy

        Neal Patel (Gerrit)

        unread,
        Apr 28, 2026, 8:51:58 PM (8 hours ago) Apr 28
        to goph...@pubsubhelper.golang.org, golang-...@googlegroups.com, Nicholas Husin, golang...@luci-project-accounts.iam.gserviceaccount.com, Nicholas Husin, Roland Shoemaker, golang-co...@googlegroups.com

        Neal Patel submitted the change

        Unreviewed changes

        2 is the latest approved patch-set.
        No files were changed between the latest approved patch-set and the submitted one.

        Change information

        Commit message:
        net/mail: fix quadratic consumePhrase behavior

        Updates #78987
        Fixes CVE-2026-42499
        Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f
        Reviewed-by: Nicholas Husin <hu...@google.com>
        Reviewed-by: Nicholas Husin <n...@golang.org>
        Files:
        • M src/net/mail/message.go
        • M src/net/mail/message_test.go
        Change size: S
        Delta: 2 files changed, 28 insertions(+), 6 deletions(-)
        Branch: refs/heads/master
        Submit Requirements:
         Open in Gerrit
        Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
        


         Gerrit-MessageType: merged 
        

         Gerrit-Project: go 
        

         Gerrit-Branch: master 
        

         Gerrit-Change-Id: I8438e5dee7e6433573d4161baf8fb2151e7fbc2f 
        

         Gerrit-Change-Number: 771520 
        

         Gerrit-PatchSet: 4 
        open
        diffy
        satisfied_requirement
        Reply all
        Reply to author
        Forward
        0 new messages