Re: [PATCH 1/2] http-backend: Fix access beyond end of string.
From: Shawn O. Pearce <hidden>
Date: 2016-06-15 22:47:43
Subsystem:
the rest · Maintainer:
Linus Torvalds
Tarmigan Casebolt [off-list ref] wrote:
quoted hunk ↗ jump to hunk
diff --git a/http-backend.c b/http-backend.c index f8ea9d7..ab9433d 100644 --- a/http-backend.c +++ b/http-backend.c@@ -634,7 +634,7 @@ int main(int argc, char **argv) cmd = c; cmd_arg = xmalloc(n); strncpy(cmd_arg, dir + out[0].rm_so + 1, n); - cmd_arg[n] = '\0'; + cmd_arg[n-1] = '\0'; dir[out[0].rm_so] = 0; break;
Shouldn't this instead be:
diff --git a/http-backend.c b/http-backend.c
index 9021266..16ec635 100644
--- a/http-backend.c
+++ b/http-backend.c@@ -626,7 +626,7 @@ int main(int argc, char **argv) } cmd = c; - cmd_arg = xmalloc(n); + cmd_arg = xmalloc(n + 1); strncpy(cmd_arg, dir + out[0].rm_so + 1, n); cmd_arg[n] = '\0'; dir[out[0].rm_so] = 0;
The cmd_arg string was simply allocated too small. Your fix is terminating the string one character too short which would cause get_loose_object and get_pack_file to break. -- Shawn.