From: Junio C Hamano <gitster@pobox•com>
To: Jeff King <peff@peff•net>
Cc: "Shawn O. Pearce" <spearce@spearce•org>,
Tarmigan Casebolt <tarmigan+git@gmail•com>,
Junio C Hamano <gitster@pobox•com>,
git@vger•kernel.org
Subject: Re: [PATCH 1/2] http-backend: Fix access beyond end of string.
Date: Sun, 15 Nov 2009 22:12:31 -0800 [thread overview]
Message-ID: <7viqdb0zhs.fsf@alter.siamese.dyndns.org> (raw)
In-Reply-To: <20091116045532.GC14664@coredump.intra.peff.net> (Jeff King's message of "Sun\, 15 Nov 2009 23\:55\:32 -0500")
Jeff King <peff@peff•net> writes:
> On Sun, Nov 15, 2009 at 05:36:54PM -0800, Shawn O. Pearce wrote:
> ...
>> Shouldn't this instead be:
>>
>> diff --git a/http-backend.c b/http-backend.c
>> index 9021266..16ec635 100644
>> --- a/http-backend.c
>> +++ b/http-backend.c
>> @@ -626,7 +626,7 @@ int main(int argc, char **argv)
>> }
>>
>> cmd = c;
>> - cmd_arg = xmalloc(n);
>> + cmd_arg = xmalloc(n + 1);
>> strncpy(cmd_arg, dir + out[0].rm_so + 1, n);
>> cmd_arg[n] = '\0';
>> dir[out[0].rm_so] = 0;
>>
>> The cmd_arg string was simply allocated too small. Your fix is
>> terminating the string one character too short which would cause
>> get_loose_object and get_pack_file to break.
>
> Actually, from my reading, I think his fix is right, because you trim
> the first character during the strncpy (using "out[0].rm_so + 1").
Your regexps all start with leading "/", and rm_so+1 points at the
character after the slash; the intention being that you would copy
the rest of the matched sequence without the leading "/".
So allocating n = rm_eo - rm_so is Ok. It counts the space for
terminating NUL. But copying "up to n bytes" using strncpy(), only to NUL
terminate immediately later, is dubious. You would want to copy only n-1
bytes. I.e.
n = out[0].rm_eo - out[0].rm_so; /* allocation */
... validate and fail invalid method ...
cmd_arg = xmalloc(n);
memcpy(cmd_arg, dir + out[0].rm_so + 1, n-1);
cmd_arg[n-1] = '\0';
next prev parent reply other threads:[~2009-11-16 6:12 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-11-14 21:10 [PATCH 1/2] http-backend: Fix access beyond end of string Tarmigan Casebolt
2009-11-14 21:10 ` [PATCH 2/2] http-backend: Let gcc check the format of more printf-type functions Tarmigan Casebolt
2009-11-16 1:39 ` Shawn O. Pearce
2009-11-16 1:36 ` [PATCH 1/2] http-backend: Fix access beyond end of string Shawn O. Pearce
2009-11-16 4:55 ` Jeff King
2009-11-16 6:12 ` Junio C Hamano [this message]
2009-11-17 4:46 ` Tarmigan
2009-11-23 17:20 ` Brian Gernhardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7viqdb0zhs.fsf@alter.siamese.dyndns.org \
--to=gitster@pobox$(echo .)com \
--cc=git@vger$(echo .)kernel.org \
--cc=peff@peff$(echo .)net \
--cc=spearce@spearce$(echo .)org \
--cc=tarmigan+git@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox