@ttsc/win32-arm64 0.33.0 → 0.34.0

package/bin/go/src/image/format.go

@@ -84,6 +84,12 @@ func sniff(r reader) format {
 // The string returned is the format name used during format registration.
 // Format registration is typically done by an init function in the codec-
 // specific package.
+//
+// Decoding may allocate memory proportional to the width and height in the
+// image header before all pixel data is consumed or validated. When
+// decoding untrusted input, call [DecodeConfig] first to inspect dimensions
+// and reject images that would exceed resource limits; see the "Security
+// Considerations" section in the [image] package documentation.
 func Decode(r io.Reader) (Image, string, error) {
 	rr := asReader(r)
 	f := sniff(rr)
@@ -98,6 +104,9 @@ func Decode(r io.Reader) (Image, string, error) {
 // been encoded in a registered format. The string returned is the format name
 // used during format registration. Format registration is typically done by
 // an init function in the codec-specific package.
+//
+// DecodeConfig reads only format headers and does not allocate a full-size
+// pixel buffer, so it can be used to check dimensions before calling [Decode].
 func DecodeConfig(r io.Reader) (Config, string, error) {
 	rr := asReader(r)
 	f := sniff(rr)

package/bin/go/src/image/gif/reader.go

@@ -5,6 +5,10 @@
 // Package gif implements a GIF image decoder and encoder.
 //
 // The GIF specification is at https://www.w3.org/Graphics/GIF/spec-gif89a.txt.
+//
+// When decoding untrusted input, read dimensions with [DecodeConfig] before
+// calling [Decode] or [DecodeAll]; see those functions and the "Security
+// Considerations" section in the [image] package documentation.
 package gif
 
 import (
@@ -562,6 +566,11 @@ func uninterlace(m *image.Paletted) {
 
 // Decode reads a GIF image from r and returns the first embedded
 // image as an [image.Image].
+//
+// When decoding images from untrusted sources, it is safest to
+// first call DecodeConfig and check the image size so
+// that unexpectedly large memory allocations may be safely
+// avoided.
 func Decode(r io.Reader) (image.Image, error) {
 	var d decoder
 	if err := d.decode(r, false, false); err != nil {
@@ -602,6 +611,11 @@ type GIF struct {
 
 // DecodeAll reads a GIF image from r and returns the sequential frames
 // and timing information.
+//
+// Like [Decode], this allocates a paletted buffer per frame from width and
+// height in the image descriptors. [DecodeAll] retains every decoded frame in
+// memory. For untrusted input, call [DecodeConfig] first to verify the
+// logical screen size and reject inputs that would require excessive memory.
 func DecodeAll(r io.Reader) (*GIF, error) {
 	var d decoder
 	if err := d.decode(r, false, true); err != nil {
@@ -624,6 +638,10 @@ func DecodeAll(r io.Reader) (*GIF, error) {
 
 // DecodeConfig returns the global color model and dimensions of a GIF image
 // without decoding the entire image.
+//
+// It reads the logical screen descriptor and global color table only; it does
+// not allocate pixel buffers for frames. Use it to check width and height
+// before calling [Decode] or [DecodeAll].
 func DecodeConfig(r io.Reader) (image.Config, error) {
 	var d decoder
 	if err := d.decode(r, true, false); err != nil {

package/bin/go/src/image/jpeg/huffman.go

@@ -70,6 +70,16 @@ func (d *decoder) ensureNBits(n int32) error {
 
 // receiveExtend is the composition of RECEIVE and EXTEND, specified in section
 // F.2.2.1.
+//
+// It returns the signed integer that's encoded in t bits, where t < 16. The
+// possible return values are:
+//
+//   - t ==  0:   0
+//   - t ==  1:   -1, +1
+//   - t ==  2:   -3, -2, +2, +3
+//   - t ==  3:   -7, -6, -5, -4, +4, +5, +6, +7
+//   - ...
+//   - t == 15:   -32767, -32766, ..., -16384, +16384, ..., +32766, +32767
 func (d *decoder) receiveExtend(t uint8) (int32, error) {
 	if d.bits.n < int32(t) {
 		if err := d.ensureNBits(int32(t)); err != nil {
@@ -80,9 +90,18 @@ func (d *decoder) receiveExtend(t uint8) (int32, error) {
 	d.bits.m >>= t
 	s := int32(1) << t
 	x := int32(d.bits.a>>uint8(d.bits.n)) & (s - 1)
-	if x < s>>1 {
-		x += ((-1) << t) + 1
-	}
+
+	// This adjustment, assuming two's complement, is a branchless equivalent of:
+	//
+	// if x < s>>1 {
+	//   x += ((-1) << t) + 1
+	// }
+	//
+	// sign is either -1 or 0, depending on whether x is in the low or high
+	// half of the range 0 .. 1<<t.
+	sign := (x >> (t - 1)) - 1
+	x += sign & (((-1) << t) + 1)
+
 	return x, nil
 }
 

package/bin/go/src/image/jpeg/reader.go

@@ -28,10 +28,12 @@ var errUnsupportedSubsamplingRatio = UnsupportedError("luma/chroma subsampling r
 
 // Component specification, specified in section B.2.2.
 type component struct {
-	h  int   // Horizontal sampling factor.
-	v  int   // Vertical sampling factor.
-	c  uint8 // Component identifier.
-	tq uint8 // Quantization table destination selector.
+	h       int   // Horizontal sampling factor.
+	v       int   // Vertical sampling factor.
+	c       uint8 // Component identifier.
+	tq      uint8 // Quantization table destination selector.
+	expandH int   // Horizontal expansion factor for non-standard subsampling.
+	expandV int   // Vertical expansion factor for non-standard subsampling.
 }
 
 const (
@@ -124,6 +126,10 @@ type decoder struct {
 	blackPix    []byte
 	blackStride int
 
+	// For non-standard subsampling ratios (flex mode).
+	flex       bool // True if using non-standard subsampling that requires manual pixel expansion.
+	maxH, maxV int  // Maximum horizontal and vertical sampling factors across all components.
+
 	ri    int // Restart Interval.
 	nComp int
 
@@ -364,30 +370,11 @@ func (d *decoder) processSOF(n int) error {
 			h, v = 1, 1
 
 		case 3:
-			// For YCbCr images, we only support 4:4:4, 4:4:0, 4:2:2, 4:2:0,
-			// 4:1:1 or 4:1:0 chroma subsampling ratios. This implies that the
-			// (h, v) values for the Y component are either (1, 1), (1, 2),
-			// (2, 1), (2, 2), (4, 1) or (4, 2), and the Y component's values
-			// must be a multiple of the Cb and Cr component's values. We also
-			// assume that the two chroma components have the same subsampling
-			// ratio.
-			switch i {
-			case 0: // Y.
-				// We have already verified, above, that h and v are both
-				// either 1, 2 or 4, so invalid (h, v) combinations are those
-				// with v == 4.
-				if v == 4 {
-					return errUnsupportedSubsamplingRatio
-				}
-			case 1: // Cb.
-				if d.comp[0].h%h != 0 || d.comp[0].v%v != 0 {
-					return errUnsupportedSubsamplingRatio
-				}
-			case 2: // Cr.
-				if d.comp[1].h != h || d.comp[1].v != v {
-					return errUnsupportedSubsamplingRatio
-				}
-			}
+			// For YCbCr images, we support both standard subsampling ratios
+			// (4:4:4, 4:4:0, 4:2:2, 4:2:0, 4:1:1, 4:1:0) and non-standard ratios
+			// where components may have different sampling factors. The only
+			// restriction is that each component's sampling factors must evenly
+			// divide the maximum factors (validated after the loop).
 
 		case 4:
 			// For 4-component images (either CMYK or YCbCrK), we only support two
@@ -415,9 +402,27 @@ func (d *decoder) processSOF(n int) error {
 			}
 		}
 
+		d.maxH, d.maxV = max(d.maxH, h), max(d.maxV, v)
 		d.comp[i].h = h
 		d.comp[i].v = v
 	}
+
+	// For 3-component images, validate that maxH and maxV are evenly divisible
+	// by each component's sampling factors.
+	if d.nComp == 3 {
+		for i := 0; i < 3; i++ {
+			if d.maxH%d.comp[i].h != 0 || d.maxV%d.comp[i].v != 0 {
+				return errUnsupportedSubsamplingRatio
+			}
+		}
+	}
+
+	// Compute expansion factors for each component.
+	for i := 0; i < d.nComp; i++ {
+		d.comp[i].expandH = d.maxH / d.comp[i].h
+		d.comp[i].expandV = d.maxV / d.comp[i].v
+	}
+
 	return nil
 }
 
@@ -750,7 +755,27 @@ func (d *decoder) isRGB() bool {
 }
 
 func (d *decoder) convertToRGB() (image.Image, error) {
-	cScale := d.comp[0].h / d.comp[1].h
+	// Historically, we only supported 4:4:4, 4:4:0, 4:2:2, 4:2:0, 4:1:1 or
+	// 4:1:0 chroma subsampling ratios. Other configurations (including situations
+	// where Chroma-Blue and Chroma-Red have different subsampling) are very rare,
+	// but not impossible. That restriction was relaxed in Go 1.27 (2026).
+	//
+	// It's also very rare but not impossible for 3-channel JPEG images to be
+	// RGB instead of YCbCr, in which case this convertToRGB function will be
+	// called. Note that RGB-instead-of-YCbCr is a property of the JPEG file
+	// itself (in the SOF marker), not of the Go code decoding the image.
+	//
+	// convertToRGB still makes those historical assumptions and does not
+	// support the intersection of (1) atypical chroma subsampling and (2)
+	// RGB-instead-of-YCbCr. Both of those are very rare and the intersection
+	// is even more so.
+	h0, h1, h2 := d.comp[0].h, d.comp[1].h, d.comp[2].h
+	v0, v1, v2 := d.comp[0].v, d.comp[1].v, d.comp[2].v
+	if (h1 != h2) || (h0%h1 != 0) || (v1 != v2) || (v0%v1 != 0) {
+		return nil, errUnsupportedSubsamplingRatio
+	}
+
+	cScale := h0 / h1
 	bounds := d.img3.Bounds()
 	img := image.NewRGBA(bounds)
 	for y := bounds.Min.Y; y < bounds.Max.Y; y++ {

package/bin/go/src/image/jpeg/scan.go

@@ -16,28 +16,37 @@ func (d *decoder) makeImg(mxx, myy int) {
 		return
 	}
 
-	h0 := d.comp[0].h
-	v0 := d.comp[0].v
-	hRatio := h0 / d.comp[1].h
-	vRatio := v0 / d.comp[1].v
-	var subsampleRatio image.YCbCrSubsampleRatio
-	switch hRatio<<4 | vRatio {
-	case 0x11:
-		subsampleRatio = image.YCbCrSubsampleRatio444
-	case 0x12:
-		subsampleRatio = image.YCbCrSubsampleRatio440
-	case 0x21:
-		subsampleRatio = image.YCbCrSubsampleRatio422
-	case 0x22:
-		subsampleRatio = image.YCbCrSubsampleRatio420
-	case 0x41:
-		subsampleRatio = image.YCbCrSubsampleRatio411
-	case 0x42:
-		subsampleRatio = image.YCbCrSubsampleRatio410
-	default:
-		panic("unreachable")
+	// Determine if we need flex mode for non-standard subsampling.
+	// Flex mode is needed when:
+	// - Cb and Cr have different sampling factors, or
+	// - The Y component doesn't have the maximum sampling factors, or
+	// - The ratio doesn't match any standard YCbCrSubsampleRatio.
+	subsampleRatio := image.YCbCrSubsampleRatio444
+	if d.comp[1].h != d.comp[2].h || d.comp[1].v != d.comp[2].v ||
+		d.maxH != d.comp[0].h || d.maxV != d.comp[0].v {
+		d.flex = true
+	} else {
+		hRatio := d.maxH / d.comp[1].h
+		vRatio := d.maxV / d.comp[1].v
+		switch hRatio<<4 | vRatio {
+		case 0x11:
+			subsampleRatio = image.YCbCrSubsampleRatio444
+		case 0x12:
+			subsampleRatio = image.YCbCrSubsampleRatio440
+		case 0x21:
+			subsampleRatio = image.YCbCrSubsampleRatio422
+		case 0x22:
+			subsampleRatio = image.YCbCrSubsampleRatio420
+		case 0x41:
+			subsampleRatio = image.YCbCrSubsampleRatio411
+		case 0x42:
+			subsampleRatio = image.YCbCrSubsampleRatio410
+		default:
+			d.flex = true
+		}
 	}
-	m := image.NewYCbCr(image.Rect(0, 0, 8*h0*mxx, 8*v0*myy), subsampleRatio)
+
+	m := image.NewYCbCr(image.Rect(0, 0, 8*d.maxH*mxx, 8*d.maxV*myy), subsampleRatio)
 	d.img3 = m.SubImage(image.Rect(0, 0, d.width, d.height)).(*image.YCbCr)
 
 	if d.nComp == 4 {
@@ -143,9 +152,11 @@ func (d *decoder) processSOS(n int) error {
 	}
 
 	// mxx and myy are the number of MCUs (Minimum Coded Units) in the image.
-	h0, v0 := d.comp[0].h, d.comp[0].v // The h and v values from the Y components.
-	mxx := (d.width + 8*h0 - 1) / (8 * h0)
-	myy := (d.height + 8*v0 - 1) / (8 * v0)
+	// The MCU dimensions are based on the maximum sampling factors.
+	// For standard subsampling, maxH/maxV equals h0/v0 (Y's factors).
+	// For flex mode, Y may not have the maximum factors.
+	mxx := (d.width + 8*d.maxH - 1) / (8 * d.maxH)
+	myy := (d.height + 8*d.maxV - 1) / (8 * d.maxV)
 	if d.img1 == nil && d.img3 == nil {
 		d.makeImg(mxx, myy)
 	}
@@ -439,16 +450,15 @@ func (d *decoder) refineNonZeroes(b *block, zig, zigEnd, nz, delta int32) (int32
 }
 
 func (d *decoder) reconstructProgressiveImage() error {
-	// The h0, mxx, by and bx variables have the same meaning as in the
+	// The mxx, by and bx variables have the same meaning as in the
 	// processSOS method.
-	h0 := d.comp[0].h
-	mxx := (d.width + 8*h0 - 1) / (8 * h0)
+	mxx := (d.width + 8*d.maxH - 1) / (8 * d.maxH)
 	for i := 0; i < d.nComp; i++ {
 		if d.progCoeffs[i] == nil {
 			continue
 		}
-		v := 8 * d.comp[0].v / d.comp[i].v
-		h := 8 * d.comp[0].h / d.comp[i].h
+		v := 8 * d.maxV / d.comp[i].v
+		h := 8 * d.maxH / d.comp[i].h
 		stride := mxx * d.comp[i].h
 		for by := 0; by*v < d.height; by++ {
 			for bx := 0; bx*h < d.width; bx++ {
@@ -469,6 +479,15 @@ func (d *decoder) reconstructBlock(b *block, bx, by, compIndex int) error {
 		b[unzig[zig]] *= qt[zig]
 	}
 	idct(b)
+
+	var h, v int
+	if d.flex {
+		// Flex mode: scale bx and by according to the component's sampling factors.
+		h = d.comp[compIndex].expandH
+		v = d.comp[compIndex].expandV
+		bx, by = bx*h, by*v
+	}
+
 	dst, stride := []byte(nil), 0
 	if d.nComp == 1 {
 		dst, stride = d.img1.Pix[8*(by*d.img1.Stride+bx):], d.img1.Stride
@@ -486,20 +505,31 @@ func (d *decoder) reconstructBlock(b *block, bx, by, compIndex int) error {
 			return UnsupportedError("too many components")
 		}
 	}
+
+	if d.flex {
+		// Flex mode: expand each source pixel to h×v destination pixels.
+		for y := 0; y < 8; y++ {
+			y8 := y * 8
+			yv := y * v
+			for x := 0; x < 8; x++ {
+				val := uint8(max(0, min(255, b[y8+x]+128)))
+				xh := x * h
+				for yy := 0; yy < v; yy++ {
+					for xx := 0; xx < h; xx++ {
+						dst[(yv+yy)*stride+xh+xx] = val
+					}
+				}
+			}
+		}
+		return nil
+	}
+
 	// Level shift by +128, clip to [0, 255], and write to dst.
 	for y := 0; y < 8; y++ {
 		y8 := y * 8
 		yStride := y * stride
 		for x := 0; x < 8; x++ {
-			c := b[y8+x]
-			if c < -128 {
-				c = 0
-			} else if c > 127 {
-				c = 255
-			} else {
-				c += 128
-			}
-			dst[yStride+x] = uint8(c)
+			dst[yStride+x] = uint8(max(0, min(255, b[y8+x]+128)))
 		}
 	}
 	return nil

package/bin/go/src/image/png/writer.go

@@ -581,12 +581,20 @@ func (e *encoder) writeIEND() { e.writeChunk(nil, "IEND") }
 
 // Encode writes the Image m to w in PNG format. Any Image may be
 // encoded, but images that are not [image.NRGBA] might be encoded lossily.
+//
+// Note that the exact bytes written to w are not covered by the Go 1
+// compatibility promise. Callers, including tests, should not depend on the
+// exact written bytes.
 func Encode(w io.Writer, m image.Image) error {
 	var e Encoder
 	return e.Encode(w, m)
 }
 
 // Encode writes the Image m to w in PNG format.
+//
+// Note that the exact bytes written to w are not covered by the Go 1
+// compatibility promise. Callers, including tests, should not depend on the
+// exact written bytes.
 func (enc *Encoder) Encode(w io.Writer, m image.Image) error {
 	// Obviously, negative widths and heights are invalid. Furthermore, the PNG
 	// spec section 11.2.2 says that zero is invalid. Excessively large images are

package/bin/go/src/index/suffixarray/suffixarray.go

@@ -117,11 +117,11 @@ func writeSlice(w io.Writer, buf []byte, data ints) (n int, err error) {
 	return
 }
 
-var errTooBig = errors.New("suffixarray: data too large")
+var errCorrupted = errors.New("suffixarray: data corrupted")
 
-// readSlice reads data[:n] from r and returns n.
+// readSlice reads data[:n] from r and returns n; maxIndex is the length of the suffix array.
 // It uses buf to buffer the read.
-func readSlice(r io.Reader, buf []byte, data ints) (n int, err error) {
+func readSlice(r io.Reader, buf []byte, data ints, maxIndex uint64) (n int, err error) {
 	// read buffer size
 	var size64 int64
 	size64, err = readInt(r, buf)
@@ -130,7 +130,7 @@ func readSlice(r io.Reader, buf []byte, data ints) (n int, err error) {
 	}
 	if int64(int(size64)) != size64 || int(size64) < 0 {
 		// We never write chunks this big anyway.
-		return 0, errTooBig
+		return 0, errCorrupted
 	}
 	size := int(size64)
 
@@ -140,8 +140,16 @@ func readSlice(r io.Reader, buf []byte, data ints) (n int, err error) {
 	}
 
 	// decode as many elements as present in buf
+	len := data.len()
 	for p := binary.MaxVarintLen64; p < size; n++ {
 		x, w := binary.Uvarint(buf[p:])
+		// - prevent index-out-of-bounds panic if there are more indices than expected
+		// (was go.dev/issue/53352)
+		// - prevent index-out-of-bounds panic in a future Lookup
+		// by ensuring all indices x satisfy x < maxIndex
+		if n >= len || x >= maxIndex {
+			return n, errCorrupted
+		}
 		data.set(n, int64(x))
 		p += w
 	}
@@ -162,7 +170,7 @@ func (x *Index) Read(r io.Reader) error {
 		return err
 	}
 	if int64(int(n64)) != n64 || int(n64) < 0 {
-		return errTooBig
+		return errCorrupted
 	}
 	n := int(n64)
 
@@ -192,7 +200,7 @@ func (x *Index) Read(r io.Reader) error {
 	// read index
 	sa := x.sa
 	for sa.len() > 0 {
-		n, err := readSlice(r, buf, sa)
+		n, err := readSlice(r, buf, sa, uint64(n))
 		if err != nil {
 			return err
 		}

package/bin/go/src/internal/abi/abi_generic.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !goexperiment.regabiargs && !amd64 && !arm64 && !loong64 && !ppc64 && !ppc64le && !riscv64
+//go:build !goexperiment.regabiargs && !amd64 && !arm64 && !loong64 && !ppc64 && !ppc64le && !riscv64 && !s390x
 
 package abi
 

package/bin/go/src/internal/abi/abi_s390x.go

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build goexperiment.regabiargs
-
 package abi
 
 const (

package/bin/go/src/internal/abi/compiletype.go

@@ -26,3 +26,33 @@ func TFlagOff(ptrSize int) int { return 2*ptrSize + 4 }
 
 // ITabTypeOff returns the offset of ITab.Type for a compilation target with a given ptrSize
 func ITabTypeOff(ptrSize int) int { return ptrSize }
+
+// RTypeSize returns sizeof(kindType) for a compilation target with a given ptrSize.
+func RTypeSize(kind Kind, ptrSize int) int {
+	cs := CommonSize(ptrSize)
+	switch kind {
+	case Struct: // reflect.structType
+		return cs + 4*ptrSize
+	case Pointer: // reflect.ptrType
+		return cs + ptrSize
+	case Func: // reflect.funcType
+		return cs + ptrSize // 4 bytes, pointer aligned
+	case Slice: // reflect.sliceType
+		return cs + ptrSize
+	case Array: // reflect.arrayType
+		return cs + 3*ptrSize
+	case Chan: // reflect.chanType
+		return cs + 2*ptrSize
+	case Map: // internal/abi.MapType
+		sz := cs + 10*ptrSize + 4
+		if ptrSize == 8 {
+			sz += 4 // padding for final uint32 field (Flags).
+		}
+		return sz
+	case Interface: // reflect.interfaceType
+		return cs + 4*ptrSize
+	default:
+		// just Sizeof(rtype)
+		return cs
+	}
+}

package/bin/go/src/internal/abi/iface.go

@@ -4,7 +4,10 @@
 
 package abi
 
-import "unsafe"
+import (
+	"internal/goarch"
+	"unsafe"
+)
 
 // The first word of every non-empty interface type contains an *ITab.
 // It records the underlying concrete type (Type), the interface type it
@@ -18,6 +21,15 @@ type ITab struct {
 	Fun   [1]uintptr // variable sized. fun[0]==0 means Type does not implement Inter.
 }
 
+// Size returns the size of the itab in memory.
+func (it *ITab) Size() int {
+	size := int(unsafe.Sizeof(ITab{}))
+	if it.Fun[0] == 0 {
+		return size
+	}
+	return size + (len(it.Inter.Methods)-1)*goarch.PtrSize
+}
+
 // EmptyInterface describes the layout of a "interface{}" or a "any."
 // These are represented differently than non-empty interface, as the first
 // word always points to an abi.Type.

package/bin/go/src/internal/abi/map.go

@@ -37,9 +37,27 @@ type MapType struct {
 	// function for hashing keys (ptr to key, seed) -> hash
 	Hasher    func(unsafe.Pointer, uintptr) uintptr
 	GroupSize uintptr // == Group.Size_
-	SlotSize  uintptr // size of key/elem slot
-	ElemOff   uintptr // offset of elem in key/elem slot
-	Flags     uint32
+	// These fields describe how to access keys and elems within a group.
+	// The formulas key(i) = KeysOff + i*KeyStride and
+	// elem(i) = ElemsOff + i*ElemStride work for both group layouts:
+	//
+	// With GOEXPERIMENT=mapsplitgroup (split arrays KKKKVVVV):
+	//   KeysOff    = offset of keys array in group
+	//   KeyStride  = size of a single key
+	//   ElemsOff   = offset of elems array in group
+	//   ElemStride = size of a single elem
+	//
+	// Without (interleaved slots KVKVKVKV):
+	//   KeysOff    = offset of slots array in group
+	//   KeyStride  = size of a key/elem slot (stride between keys)
+	//   ElemsOff   = offset of first elem (slots offset + elem offset within slot)
+	//   ElemStride = size of a key/elem slot (stride between elems)
+	KeysOff    uintptr
+	KeyStride  uintptr
+	ElemsOff   uintptr
+	ElemStride uintptr
+	ElemOff    uintptr // GOEXPERIMENT=nomapsplitgroup only
+	Flags      uint32
 }
 
 // Flag values