Backport of fix https://go-review.googlesource.com/c/go/+/533215/ to …

…Go1.18 (CVE-2023-39323)

misc/cgo/errors/errors_test.go

@@ -106,6 +106,7 @@ func TestReportsTypeErrors(t *testing.T) {
 	for _, file := range []string{
 		"err1.go",
 		"err2.go",
+		"err5.go",
 		"issue11097a.go",
 		"issue11097b.go",
 		"issue18452.go",

misc/cgo/errors/testdata/err5.go

@@ -0,0 +1,7 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+package main
+//line /tmp/_cgo_.go:1
+//go:cgo_dynamic_linker "/elf/interp" // ERROR HERE: only allowed in cgo-generated code
+func main() {}

src/cmd/compile/internal/noder/noder.go

@@ -1735,8 +1735,14 @@ func (p *noder) pragma(pos syntax.Pos, blankLine bool, text string, old syntax.P
 // contain cgo directives, and for security reasons
 // (primarily misuse of linker flags), other files are not.
 // See golang.org/issue/23672.
+// Note that cmd/go ignores files whose names start with underscore,
+// so the only _cgo_ files we will see from cmd/go are generated by cgo.
+// It's easy to bypass this check by calling the compiler directly;
+// we only protect against uses by cmd/go.
 func isCgoGeneratedFile(pos syntax.Pos) bool {
-	return strings.HasPrefix(filepath.Base(trimFilename(pos.Base())), "_cgo_")
+        // We need the absolute file, independent of //line directives,
+        // so we call pos.Base().Pos().
+        return strings.HasPrefix(filepath.Base(trimFilename(pos.Base().Pos().Base())), "_cgo_")
 }
 
 // safeArg reports whether arg is a "safe" command-line argument,