Re: [PATCH 3/3] write_sha1_file_prepare: fix buffer overrun with extra-long object type
From: Junio C Hamano <hidden>
Date: 2016-06-15 23:04:38
Subsystem:
the rest · Maintainer:
Linus Torvalds
Possibly related (same subject, not in this thread)
- 2016-06-15 · [PATCH 3/3] write_sha1_file_prepare: fix buffer overrun with extra-long object type · Eric Sunshine <hidden>
- 2016-06-15 · Re: [PATCH 3/3] write_sha1_file_prepare: fix buffer overrun with extra-long object type · Junio C Hamano <hidden>
By the way, you would notice that "if we have returnsha1, then copy that in" bit is not in the new literally codepath but still is in write_sha1_file(). I do not think any caller passes a NULL as return_sha1 in today's code, which made me curious. It turns out to be a remnant of d6d3f9d0 (This implements the new "recursive tree" write-tree., 2005-04-09); before that change, write_sha1_file() did not have an ability to tell the caller what object it wrote, and Linus made it optional for the callers when he added the return_sha1[] out parameter, but all of its callers did want the resulting object name. So I think it is safe and sensible to do the following change regardless of "hash-object --literally" fix. sha1_file.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/sha1_file.c b/sha1_file.c
index c8ab069..96e813f 100644
--- a/sha1_file.c
+++ b/sha1_file.c@@ -3002,9 +3002,8 @@ static int freshen_packed_object(const unsigned char *sha1) return find_pack_entry(sha1, &e) && freshen_file(e.p->pack_name); } -int write_sha1_file(const void *buf, unsigned long len, const char *type, unsigned char *returnsha1) +int write_sha1_file(const void *buf, unsigned long len, const char *type, unsigned char *sha1) { - unsigned char sha1[20]; char hdr[32]; int hdrlen;
@@ -3012,8 +3011,6 @@ int write_sha1_file(const void *buf, unsigned long len, const char *type, unsign * it out into .git/objects/??/?{38} file. */ write_sha1_file_prepare(buf, len, type, sha1, hdr, &hdrlen); - if (returnsha1) - hashcpy(returnsha1, sha1); if (freshen_loose_object(sha1) || freshen_packed_object(sha1)) return 0; return write_loose_object(sha1, hdr, hdrlen, buf, len, 0);