Re: [PATCH v5 01/16] reftable: fix OOB stack write in print functions
From: Junio C Hamano <hidden>
Date: 2021-12-22 22:51:29
"Han-Wen Nienhuys via GitGitGadget" [off-list ref] writes:
quoted hunk ↗ jump to hunk
From: Han-Wen Nienhuys <redacted> Signed-off-by: Han-Wen Nienhuys <redacted> --- reftable/record.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/reftable/record.c b/reftable/record.c index 6a5dac32dc6..8536bd03aa9 100644 --- a/reftable/record.c +++ b/reftable/record.c@@ -254,7 +254,7 @@ static void hex_format(char *dest, uint8_t *src, int hash_size) void reftable_ref_record_print(struct reftable_ref_record *ref, uint32_t hash_id) { - char hex[2 * GIT_SHA256_RAWSZ + 1] = { 0 }; /* BUG */ + char hex[GIT_MAX_HEXSZ + 1] = { 0 }; /* BUG */ printf("ref{%s(%" PRIu64 ") ", ref->refname, ref->update_index); switch (ref->value_type) { case REFTABLE_REF_SYMREF:@@ -586,7 +586,7 @@ static struct reftable_record_vtable reftable_obj_record_vtable = { void reftable_log_record_print(struct reftable_log_record *log, uint32_t hash_id) { - char hex[GIT_SHA256_RAWSZ + 1] = { 0 }; + char hex[GIT_MAX_HEXSZ + 1] = { 0 }; switch (log->value_type) { case REFTABLE_LOG_DELETION:
Wow. The first one is future-proofing in case we learn to use even larger hash, but the latter is an outright bug that makes reviewers feel embarrassed, isn't it? Thanks for noticing and fixing it.