Re: [PATCH] setup: Fix windows path buffer over-stepping
From: Junio C Hamano <hidden>
Date: 2016-06-15 23:00:49
Martin Erik Werner [off-list ref] writes:
Fix a buffer over-stepping issue triggered by providing an absolute path
that is similar to the work tree path.
abspath_part_inside_repo() may currently increment the path pointer by
offset_1st_component() + wtlen, which is too much, since
offset_1st_component() is a subset of wtlen.
For the *nix-style prefix '/', this does (by luck) not cause any issues,
since offset_1st_component() is 1 and there will always be a '/' or '\0'
that can "absorb" this.
In the case of DOS-style prefixes though, the offset_1st_component() is
3 and this can potentially over-step the string buffer. For example if
work_tree = "c:/r"
path = "c:/rl"
Then wtlen is 4, and incrementing the path pointer by (3 + 4) would
end up 2 bytes outside a string buffer of length 6.
Similarly if
work_tree = "c:/r"
path = "c:/rl/d/a"
Then (since the loop starts by also incrementing the pointer one step),
this would mean that the function would miss checking if "c:/rl/d" could
be the work_tree, arguably this is unlikely though, since it would only
be possible with symlinks on windows.
Fix this by simply avoiding to increment by offset_1st_component() and
wtlen at the same time.
Signed-off-by: Martin Erik Werner <redacted>
---
This is a follow-up on 655ee9e mw/symlinks which is currently merged into
master, prospective for git v2.0.0, the issue only affects v2.0.0-rc0.Thanks for a fix and from a cursory read of the surrounding code, I think the patch makes sense. I appreciate your doing so before the breakage hits a released version very much.
quoted hunk
setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/setup.c b/setup.c index 613e3b3..0a22f8b 100644 --- a/setup.c +++ b/setup.c@@ -29,7 +29,7 @@ static int abspath_part_inside_repo(char *path) return -1; wtlen = strlen(work_tree); len = strlen(path); - off = 0; + off = offset_1st_component(path); /* check if work tree is already the prefix */ if (wtlen <= len && !strncmp(path, work_tree, wtlen)) {@@ -45,7 +45,7 @@ static int abspath_part_inside_repo(char *path) off = wtlen; } path0 = path; - path += offset_1st_component(path) + off; + path += off; /* check each '/'-terminated level */ while (*path) {