* [PATCH] setup: Fix windows path buffer over-stepping
@ 2014-04-24 13:06 Martin Erik Werner
2014-04-24 18:37 ` Junio C Hamano
0 siblings, 1 reply; 2+ messages in thread
From: Martin Erik Werner @ 2014-04-24 13:06 UTC (permalink / raw)
To: git; +Cc: Martin Erik Werner
Fix a buffer over-stepping issue triggered by providing an absolute path
that is similar to the work tree path.
abspath_part_inside_repo() may currently increment the path pointer by
offset_1st_component() + wtlen, which is too much, since
offset_1st_component() is a subset of wtlen.
For the *nix-style prefix '/', this does (by luck) not cause any issues,
since offset_1st_component() is 1 and there will always be a '/' or '\0'
that can "absorb" this.
In the case of DOS-style prefixes though, the offset_1st_component() is
3 and this can potentially over-step the string buffer. For example if
work_tree = "c:/r"
path = "c:/rl"
Then wtlen is 4, and incrementing the path pointer by (3 + 4) would
end up 2 bytes outside a string buffer of length 6.
Similarly if
work_tree = "c:/r"
path = "c:/rl/d/a"
Then (since the loop starts by also incrementing the pointer one step),
this would mean that the function would miss checking if "c:/rl/d" could
be the work_tree, arguably this is unlikely though, since it would only
be possible with symlinks on windows.
Fix this by simply avoiding to increment by offset_1st_component() and
wtlen at the same time.
Signed-off-by: Martin Erik Werner <martinerikwerner@gmail.com>
---
This is a follow-up on 655ee9e mw/symlinks which is currently merged into
master, prospective for git v2.0.0, the issue only affects v2.0.0-rc0.
setup.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/setup.c b/setup.c
index 613e3b3..0a22f8b 100644
--- a/setup.c
+++ b/setup.c
@@ -29,7 +29,7 @@ static int abspath_part_inside_repo(char *path)
return -1;
wtlen = strlen(work_tree);
len = strlen(path);
- off = 0;
+ off = offset_1st_component(path);
/* check if work tree is already the prefix */
if (wtlen <= len && !strncmp(path, work_tree, wtlen)) {
@@ -45,7 +45,7 @@ static int abspath_part_inside_repo(char *path)
off = wtlen;
}
path0 = path;
- path += offset_1st_component(path) + off;
+ path += off;
/* check each '/'-terminated level */
while (*path) {
--
1.9.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] setup: Fix windows path buffer over-stepping
2014-04-24 13:06 [PATCH] setup: Fix windows path buffer over-stepping Martin Erik Werner
@ 2014-04-24 18:37 ` Junio C Hamano
0 siblings, 0 replies; 2+ messages in thread
From: Junio C Hamano @ 2014-04-24 18:37 UTC (permalink / raw)
To: Martin Erik Werner; +Cc: git
Martin Erik Werner <martinerikwerner@gmail.com> writes:
> Fix a buffer over-stepping issue triggered by providing an absolute path
> that is similar to the work tree path.
>
> abspath_part_inside_repo() may currently increment the path pointer by
> offset_1st_component() + wtlen, which is too much, since
> offset_1st_component() is a subset of wtlen.
>
> For the *nix-style prefix '/', this does (by luck) not cause any issues,
> since offset_1st_component() is 1 and there will always be a '/' or '\0'
> that can "absorb" this.
>
> In the case of DOS-style prefixes though, the offset_1st_component() is
> 3 and this can potentially over-step the string buffer. For example if
>
> work_tree = "c:/r"
> path = "c:/rl"
>
> Then wtlen is 4, and incrementing the path pointer by (3 + 4) would
> end up 2 bytes outside a string buffer of length 6.
>
> Similarly if
>
> work_tree = "c:/r"
> path = "c:/rl/d/a"
>
> Then (since the loop starts by also incrementing the pointer one step),
> this would mean that the function would miss checking if "c:/rl/d" could
> be the work_tree, arguably this is unlikely though, since it would only
> be possible with symlinks on windows.
>
> Fix this by simply avoiding to increment by offset_1st_component() and
> wtlen at the same time.
>
> Signed-off-by: Martin Erik Werner <martinerikwerner@gmail.com>
> ---
>
> This is a follow-up on 655ee9e mw/symlinks which is currently merged into
> master, prospective for git v2.0.0, the issue only affects v2.0.0-rc0.
Thanks for a fix and from a cursory read of the surrounding code, I
think the patch makes sense.
I appreciate your doing so before the breakage hits a released
version very much.
> setup.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/setup.c b/setup.c
> index 613e3b3..0a22f8b 100644
> --- a/setup.c
> +++ b/setup.c
> @@ -29,7 +29,7 @@ static int abspath_part_inside_repo(char *path)
> return -1;
> wtlen = strlen(work_tree);
> len = strlen(path);
> - off = 0;
> + off = offset_1st_component(path);
>
> /* check if work tree is already the prefix */
> if (wtlen <= len && !strncmp(path, work_tree, wtlen)) {
> @@ -45,7 +45,7 @@ static int abspath_part_inside_repo(char *path)
> off = wtlen;
> }
> path0 = path;
> - path += offset_1st_component(path) + off;
> + path += off;
>
> /* check each '/'-terminated level */
> while (*path) {
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-04-24 18:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-04-24 13:06 [PATCH] setup: Fix windows path buffer over-stepping Martin Erik Werner
2014-04-24 18:37 ` Junio C Hamano
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).