[PATCH 3/6] revert: Fix buffer overflow in insn sheet parser
From: Ramkumar Ramachandra <hidden>
Date: 2016-06-15 22:52:12
Subsystem:
the rest · Maintainer:
Linus Torvalds
Check that the commit name argument to a "pick" or "revert" action in '.git/sequencer/todo' is not too long, to avoid overflowing an on-stack buffer. This fixes a regression introduced by 5a5d80f4 (revert: Introduce --continue to continue the operation, 2011-08-04). Reported-by: Jonathan Nieder <redacted> Acked-by: Jonathan Nieder <redacted> Signed-off-by: Ramkumar Ramachandra <redacted> --- builtin/revert.c | 2 +- t/t3510-cherry-pick-sequence.sh | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletions(-)
diff --git a/builtin/revert.c b/builtin/revert.c
index b3c5e0e..6451089 100644
--- a/builtin/revert.c
+++ b/builtin/revert.c@@ -707,7 +707,7 @@ static struct commit *parse_insn_line(char *start, struct replay_opts *opts) return NULL; q = strchr(p, ' '); - if (!q) + if (!q || q - p + 1 > sizeof(sha1_abbrev)) return NULL; q++;
diff --git a/t/t3510-cherry-pick-sequence.sh b/t/t3510-cherry-pick-sequence.sh
index 3bca2b3..2113308 100755
--- a/t/t3510-cherry-pick-sequence.sh
+++ b/t/t3510-cherry-pick-sequence.sh@@ -12,6 +12,9 @@ test_description='Test cherry-pick continuation features . ./test-lib.sh +# Repeat first match 10 times +_r10='\1\1\1\1\1\1\1\1\1\1' + pristine_detach () { git cherry-pick --reset && git checkout -f "$1^0" &&
@@ -211,4 +214,15 @@ test_expect_success 'malformed instruction sheet 2' ' test_must_fail git cherry-pick --continue ' +test_expect_success 'malformed instruction sheet 3' ' + pristine_detach initial && + test_must_fail git cherry-pick base..anotherpick && + echo "resolved" >foo && + git add foo && + git commit && + sed "s/pick \([0-9a-f]*\)/pick $_r10/" .git/sequencer/todo >new_sheet && + cp new_sheet .git/sequencer/todo && + test_must_fail git cherry-pick --continue +' + test_done
--
1.7.4.1