* [PATCH] git-apply: do not read past the end of buffer
@ 2007-09-06 5:06 Junio C Hamano
0 siblings, 0 replies; only message in thread
From: Junio C Hamano @ 2007-09-06 5:06 UTC (permalink / raw)
To: git; +Cc: Linus Torvalds
When the preimage we are patching is shorter than what the patch
text expects, we tried to match the buffer contents at the
"original" line with the fragment in full, without checking we
have enough data to match in the preimage. This caused the size
of a later memmove() to wrap around and attempt to scribble
almost the entire address space. Not good.
The code that follows the part this patch touches tries to match
the fragment with line offsets. Curiously, that code does not
have the problem --- it guards against reading past the end of
Signed-off-by: Junio C Hamano <email@example.com>
* This is an ancient part of the code; I am somewhat surprised
that nobody has ever reported it earlier.
builtin-apply.c | 3 +-
t/t4123-apply-shrink.sh | 58 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 60 insertions(+), 1 deletions(-)
create mode 100755 t/t4123-apply-shrink.sh
diff --git a/builtin-apply.c b/builtin-apply.c
index 25b1447..976ec77 100644
@@ -1514,7 +1514,8 @@ static int find_offset(const char *buf, unsigned long size, const char *fragment
/* Exact line number? */
- if (!memcmp(buf + start, fragment, fragsize))
+ if ((start + fragsize <= size) &&
+ !memcmp(buf + start, fragment, fragsize))
diff --git a/t/t4123-apply-shrink.sh b/t/t4123-apply-shrink.sh
new file mode 100755
@@ -0,0 +1,58 @@
+test_description='apply a patch that is larger than the preimage'
+cat >F <<\EOF
+test_expect_success setup '
+ git add F &&
+ mv F G &&
+ sed -e "s/1/11/" -e "s/999999/9/" -e "s/H/HH/" <G >F &&
+ git diff >patch &&
+ sed -e "/^\$/d" <G >F &&
+ git add F
+test_expect_success 'apply should fail gracefully' '
+ if git apply --index patch
+ echo Oops, should not have succeeded
+ echo "Status was $status"
+ if test -f .git/index.lock
+ echo Oops, should not have crashed
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2007-09-06 5:06 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2007-09-06 5:06 [PATCH] git-apply: do not read past the end of buffer Junio C Hamano
Code repositories for project(s) associated with this inbox:
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).