• Brad Fitzpatrick's avatar
    strings: fix two Builder bugs allowing mutation of strings, remove ReadFrom · 3058d386
    Brad Fitzpatrick authored
    The Builder's ReadFrom method allows the underlying unsafe slice to
    escape, and for callers to subsequently modify memory that had been
    unsafely converted into an immutable string.
    
    In the original proposal for Builder (#18990), I'd noted there should
    be no Read methods:
    
    > There would be no Reset or Bytes or Truncate or Read methods.
    > Nothing that could mutate the []byte once it was unsafely converted
    > to a string.
    
    And in my prototype (https://golang.org/cl/37767), I handled ReadFrom
    properly, but when https://golang.org/cl/74931 arrived, I missed that
    it had a ReadFrom method and approved it.
    
    Because we're so close to the Go 1.10 release, just remove the
    ReadFrom method rather than think about possible fixes. It has
    marginal utility in a Builder anyway.
    
    Also, fix a separate bug that also allowed mutation of a slice's
    backing array after it had been converted into a slice by disallowing
    copies of the Builder by value.
    
    Updates #18990
    Fixes #23083
    Fixes #23084
    
    Change-Id: Id1f860f8a4f5f88b32213cf85108ebc609acb95f
    Reviewed-on: https://go-review.googlesource.com/83255Reviewed-by: 's avatarKeith Randall <khr@golang.org>
    Reviewed-by: 's avatarIan Lance Taylor <iant@golang.org>
    3058d386
builder_test.go 5.67 KB