Re: [PATCH v4 2/3] commit-graph: fix buffer read-overflow

On 2019.01.12 11:57, SZEDER Gábor wrote:

On Thu, Dec 13, 2018 at 11:43:57AM -0800, Josh Steadmon wrote:

quoted

diff --git a/t/t5318-commit-graph.sh b/t/t5318-commit-graph.sh
index 5fe21db99f..a1b5a75882 100755
--- a/t/t5318-commit-graph.sh
+++ b/t/t5318-commit-graph.sh

@@ -366,21 +366,26 @@ GRAPH_OCTOPUS_DATA_OFFSET=$(($GRAPH_COMMIT_DATA_OFFSET + \
 GRAPH_BYTE_OCTOPUS=$(($GRAPH_OCTOPUS_DATA_OFFSET + 4))
 GRAPH_BYTE_FOOTER=$(($GRAPH_OCTOPUS_DATA_OFFSET + 4 * $NUM_OCTOPUS_EDGES))
 
-# usage: corrupt_graph_and_verify <position> <data> <string>
+# usage: corrupt_graph_and_verify <position> <data> <string> [<zero_pos>]
 # Manipulates the commit-graph file at the position
-# by inserting the data, then runs 'git commit-graph verify'
+# by inserting the data, optionally zeroing the file
+# starting at <zero_pos>, then runs 'git commit-graph verify'
 # and places the output in the file 'err'. Test 'err' for
 # the given string.
 corrupt_graph_and_verify() {
 	pos=$1
 	data="${2:-\0}"
 	grepstr=$3
+	orig_size=$(wc -c < $objdir/info/commit-graph) &&

A minor nit: this test script is unusually prudent about which
directory/repository each test is executed in, as the first thing each
test does is to 'cd' into the right directory.  (I think this is a
Good Thing, and other test scripts should follow suit if they use a
repo other than $TRASH_DIRECTORY.)  Though it doesn't cause any
immediate issues (the previous test happens to use the same
repository), the above line violates this, as it accesses the
'.git/.../commit-graph' file ...

quoted

+	zero_pos=${4:-${orig_size}} &&
 	cd "$TRASH_DIRECTORY/full" &&

... before this line could ensure that it's in the right repository.

Thanks for the catch. Fixed in v5.