From: Liu Yubao <yubao.liu@gmail.com>
To: Junio C Hamano <gitster@pobox.com>
Cc: git list <git@vger.kernel.org>
Subject: [PATCH 1/5] avoid parse_sha1_header() accessing memory out of bound
Date: Tue, 02 Dec 2008 09:51:23 +0800 [thread overview]
Message-ID: <4934949B.70307@gmail.com> (raw)
In-Reply-To: <7voczws3np.fsf@gitster.siamese.dyndns.org>
Signed-off-by: Liu Yubao <yubao.liu@gmail.com>
---
sha1_file.c | 15 +++++++++------
1 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/sha1_file.c b/sha1_file.c
index 6c0e251..efe6967 100644
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -1245,8 +1245,9 @@ static void *unpack_sha1_rest(z_stream *stream, void *buffer, unsigned long size
* too permissive for what we want to check. So do an anal
* object header parse by hand.
*/
-static int parse_sha1_header(const char *hdr, unsigned long *sizep)
+static int parse_sha1_header(const char *hdr, unsigned long length, unsigned long *sizep)
{
+ const char *hdr_end = hdr + length;
char type[10];
int i;
unsigned long size;
@@ -1254,10 +1255,10 @@ static int parse_sha1_header(const char *hdr, unsigned long *sizep)
/*
* The type can be at most ten bytes (including the
* terminating '\0' that we add), and is followed by
- * a space.
+ * a space, at least one byte for size, and a '\0'.
*/
i = 0;
- for (;;) {
+ while (hdr < hdr_end - 2) {
char c = *hdr++;
if (c == ' ')
break;
@@ -1265,6 +1266,8 @@ static int parse_sha1_header(const char *hdr, unsigned long *sizep)
if (i >= sizeof(type))
return -1;
}
+ if (' ' != *(hdr - 1))
+ return -1;
type[i] = 0;
/*
@@ -1275,7 +1278,7 @@ static int parse_sha1_header(const char *hdr, unsigned long *sizep)
if (size > 9)
return -1;
if (size) {
- for (;;) {
+ while (hdr < hdr_end - 1) {
unsigned long c = *hdr - '0';
if (c > 9)
break;
@@ -1298,7 +1301,7 @@ static void *unpack_sha1_file(void *map, unsigned long mapsize, enum object_type
char hdr[8192];
ret = unpack_sha1_header(&stream, map, mapsize, hdr, sizeof(hdr));
- if (ret < Z_OK || (*type = parse_sha1_header(hdr, size)) < 0)
+ if (ret < Z_OK || (*type = parse_sha1_header(hdr, stream.total_out, size)) < 0)
return NULL;
return unpack_sha1_rest(&stream, hdr, *size, sha1);
@@ -1982,7 +1985,7 @@ static int sha1_loose_object_info(const unsigned char *sha1, unsigned long *size
if (unpack_sha1_header(&stream, map, mapsize, hdr, sizeof(hdr)) < 0)
status = error("unable to unpack %s header",
sha1_to_hex(sha1));
- else if ((status = parse_sha1_header(hdr, &size)) < 0)
+ else if ((status = parse_sha1_header(hdr, stream.total_out, &size)) < 0)
status = error("unable to parse %s header", sha1_to_hex(sha1));
else if (sizep)
*sizep = size;
--
1.6.1.rc1.5.gde86c
next prev parent reply other threads:[~2008-12-02 1:52 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-12-01 8:00 two questions about the format of loose object Liu Yubao
2008-12-01 8:25 ` Junio C Hamano
2008-12-01 9:28 ` Liu Yubao
2008-12-01 11:32 ` Jakub Narebski
2008-12-02 2:19 ` Liu Yubao
2008-12-01 15:21 ` Shawn O. Pearce
2008-12-02 2:43 ` Liu Yubao
2008-12-02 1:48 ` [PATCH 0/5] support reading and writing uncompressed " Liu Yubao
2008-12-02 1:51 ` Liu Yubao [this message]
2008-12-02 15:42 ` [PATCH 1/5] avoid parse_sha1_header() accessing memory out of bound Shawn O. Pearce
2008-12-03 3:49 ` Liu Yubao
2008-12-02 1:53 ` [PATCH 2/5] don't die immediately when convert an invalid type name Liu Yubao
2008-12-02 1:55 ` [PATCH 3/5] optimize parse_sha1_header() a little by detecting object type Liu Yubao
2008-12-02 15:53 ` Shawn O. Pearce
2008-12-03 4:06 ` Liu Yubao
2008-12-02 1:56 ` [PATCH 4/5] support reading uncompressed loose object Liu Yubao
2008-12-02 15:58 ` Shawn O. Pearce
2008-12-03 4:09 ` Liu Yubao
2008-12-02 2:03 ` [PATCH 5/5] support writing " Liu Yubao
2008-12-02 16:07 ` Shawn O. Pearce
2008-12-03 4:22 ` Liu Yubao
2008-12-02 3:11 ` [PATCH 0/5] support reading and " Liu Yubao
2008-12-01 12:16 ` two questions about the format of " Nick Andrew
2008-12-02 2:26 ` Liu Yubao
2008-12-01 15:32 ` Shawn O. Pearce
2008-12-02 3:05 ` Liu Yubao
2008-12-04 0:54 ` Nicolas Pitre
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4934949B.70307@gmail.com \
--to=yubao.liu@gmail.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).