mailing list mirror (one of many)
 help / color / mirror / code / Atom feed
From: Jeff King <>
Subject: [PATCH 3/3] pathspec: handle non-terminated strings with :(attr)
Date: Fri, 2 Nov 2018 01:23:22 -0400	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

The pathspec code always takes names to be matched as a
name/namelen pair, but match_attrs() never looks at namelen,
and just treats "name" like a NUL-terminated string, passing
it to git_check_attr().

This usually works anyway. Every caller passes a
NUL-terminated string, and in all but one the passed-in
length is the same as the length of the string (the
exception is dir_path_match(), which may pass a smaller
length to drop a trailing slash). So we won't currently ever
read random memory, and the one case I found actually
happens to work correctly because the attr code can handle
the trailing slash itself.

But it's still worth addressing, as the function interface
implies that the name does not have to be NUL-terminated,
making this an accident waiting to happen.

Since teaching git_check_attr() to take a ptr/len pair would
be a big refactor, we'll just allocate a new string. We can
do this only when necessary, which avoids paying the cost
for most callers.

Signed-off-by: Jeff King <>
 dir.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/dir.c b/dir.c
index 47c2fca8dc..ab6477d777 100644
--- a/dir.c
+++ b/dir.c
@@ -281,8 +281,15 @@ static int match_attrs(const struct index_state *istate,
 		       const struct pathspec_item *item)
 	int i;
+	char *to_free = NULL;
+	if (name[namelen])
+		name = to_free = xmemdupz(name, namelen);
 	git_check_attr(istate, name, item->attr_check);
+	free(to_free);
 	for (i = 0; i < item->attr_match_nr; i++) {
 		const char *value;
 		int matched;

      parent reply	other threads:[~2018-11-02  5:23 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-02  5:22 [PATCH 0/3] mixed bag of -Wunused-parameter bugfixes Jeff King
2018-11-02  5:22 ` [PATCH 1/3] rev-list: handle flags for --indexed-objects Jeff King
2018-11-02  5:23 ` [PATCH 2/3] approxidate: handle pending number for "specials" Jeff King
2018-11-07  0:48   ` Carlo Arenas
2018-11-07  1:12     ` Jeff King
2018-11-07  2:08       ` Junio C Hamano
2018-11-02  5:23 ` Jeff King [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

  List information:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).