[PATCH] pretty: fix buffer over-read with %> and %<

[PATCH] pretty: fix buffer over-read with %> and %<

[mwnx]

A buffer over-read of the format string would occur with unterminated
formats of the form '%>(#' and '%<(#', where '#' represents a number.

This error can be witnessed by running git log under valgrind like so:

    valgrind git log -n1 --format='%<(42'

This was due to the fact that the "not found" case for strcspn() was
being checked in the same way that one checks the "not found" case for
strchr(), i.e. by checking for a NULL pointer return value. Instead, one
must check for the end of the string since strcspn() points to the
character where it finished its search (which will be a '\0' if
unsuccessful).

Signed-off-by: mwnx <mwnx@gmx.com>
---
 pretty.c                      | 2 +-
 t/t4205-log-pretty-formats.sh | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/pretty.c b/pretty.c
index 2f6b0ae6c..4c70bad45 100644
--- a/pretty.c
+++ b/pretty.c
@@ -1021,7 +1021,7 @@ static size_t parse_padding_placeholder(struct strbuf *sb,
 		const char *end = start + strcspn(start, ",)");
 		char *next;
 		int width;
-		if (!end || end == start)
+		if (!*end || end == start)
 			return 0;
 		width = strtol(start, &next, 10);
 		if (next == start || width == 0)
diff --git a/t/t4205-log-pretty-formats.sh b/t/t4205-log-pretty-formats.sh
index 591f35daa..4d9555962 100755
--- a/t/t4205-log-pretty-formats.sh
+++ b/t/t4205-log-pretty-formats.sh
@@ -598,4 +598,10 @@ test_expect_success ':only and :unfold work together' '
 	test_cmp expect actual
 '
 
+test_expect_success 'unterminated alignment formatting' '
+	git log -n1 --format="%<(42" >actual &&
+	echo "%<(42" >expected &&
+	test_cmp expected actual
+'
+
 test_done
-- 
2.15.0.90.g6559daec7

Re: [PATCH] pretty: fix buffer over-read with %> and %<

[Junio C Hamano]

mwnx <mwnx@gmx.com> writes:

> diff --git a/pretty.c b/pretty.c
> index 2f6b0ae6c..4c70bad45 100644
> --- a/pretty.c
> +++ b/pretty.c
> @@ -1021,7 +1021,7 @@ static size_t parse_padding_placeholder(struct strbuf *sb,
>  		const char *end = start + strcspn(start, ",)");
>  		char *next;
>  		int width;
> -		if (!end || end == start)
> +		if (!*end || end == start)

Yuck.  This is so obvious a typo as it is quite clear that a few
lines above will never give us !end.  Well spotted.

By the way, Documentation/SubmittingPatches has this in "(5) Certify
your work" section:

    Also notice that a real name is used in the Signed-off-by: line. Please
    don't hide your real name.


>  			return 0;
>  		width = strtol(start, &next, 10);
>  		if (next == start || width == 0)
> diff --git a/t/t4205-log-pretty-formats.sh b/t/t4205-log-pretty-formats.sh
> index 591f35daa..4d9555962 100755
> --- a/t/t4205-log-pretty-formats.sh
> +++ b/t/t4205-log-pretty-formats.sh
> @@ -598,4 +598,10 @@ test_expect_success ':only and :unfold work together' '
>  	test_cmp expect actual
>  '
>  
> +test_expect_success 'unterminated alignment formatting' '
> +	git log -n1 --format="%<(42" >actual &&
> +	echo "%<(42" >expected &&
> +	test_cmp expected actual
> +'
> +
>  test_done

Re: [PATCH] pretty: fix buffer over-read with %> and %<

[mwnx]

On Mon, Nov 27, 2017 at 10:46:23AM +0900, Junio C Hamano wrote:
> By the way, Documentation/SubmittingPatches has this in "(5) Certify
> your work" section:
> 
>     Also notice that a real name is used in the Signed-off-by: line. Please
>     don't hide your real name.

I did read that document, but I saw a few commits which were signed
off with an alias so I figured the rule might be flexible
(especially since I'm not quite sure what the rationale behind it
is). I'd rather not give my full name if I can avoid it, however if
I really can't convince you to accept this patch any other way, I
guess I'll comply. What are your thoughts on this issue?

-- 
mwnx
GPG: AEC9 554B 07BD F60D 75A3  AF6A 44E8 E4D4 0312 C726

Re: [PATCH] pretty: fix buffer over-read with %> and %<

[Junio C Hamano]

mwnx <mwnx@gmx.com> writes:

> On Mon, Nov 27, 2017 at 10:46:23AM +0900, Junio C Hamano wrote:
>> By the way, Documentation/SubmittingPatches has this in "(5) Certify
>> your work" section:
>> 
>>     Also notice that a real name is used in the Signed-off-by: line. Please
>>     don't hide your real name.
>
> (especially since I'm not quite sure what the rationale behind it
> is).

As DCO is something we'd need to present to the court when the next
SCO comes after us, we'd prefer to see that we can refer to, and
contact if necessary, a real person when we need to say "this is not
a stolen code, here is the person who presented it to us and we'll
let him or her explain".

> What are your thoughts on this issue?

Not limited to this, but our stance for things are that previous
mistakes do not justify repeating and spreading the same.

[PATCH] pretty: fix buffer over-read with %> and %<

[mwnx]

A buffer over-read of the format string would occur with unterminated
formats of the form '%>(#' and '%<(#', where '#' represents a number.

This error can be witnessed by running git log under valgrind like so:

    valgrind git log -n1 --format='%<(42'

This was due to the fact that the "not found" case for strcspn() was
being checked in the same way that one checks the "not found" case for
strchr(), i.e. by checking for a NULL pointer return value. Instead, one
must check for the end of the string since strcspn() points to the
character where it finished its search (which will be a '\0' if
unsuccessful).

Signed-off-by: Maxwell Nixie <mwnx@gmx.com>
---
Hope I got everything right.

 pretty.c                      | 2 +-
 t/t4205-log-pretty-formats.sh | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/pretty.c b/pretty.c
index 2f6b0ae6c..4c70bad45 100644
--- a/pretty.c
+++ b/pretty.c
@@ -1021,7 +1021,7 @@ static size_t parse_padding_placeholder(struct strbuf *sb,
 		const char *end = start + strcspn(start, ",)");
 		char *next;
 		int width;
-		if (!end || end == start)
+		if (!*end || end == start)
 			return 0;
 		width = strtol(start, &next, 10);
 		if (next == start || width == 0)
diff --git a/t/t4205-log-pretty-formats.sh b/t/t4205-log-pretty-formats.sh
index 591f35daa..4d9555962 100755
--- a/t/t4205-log-pretty-formats.sh
+++ b/t/t4205-log-pretty-formats.sh
@@ -598,4 +598,10 @@ test_expect_success ':only and :unfold work together' '
 	test_cmp expect actual
 '
 
+test_expect_success 'unterminated alignment formatting' '
+	git log -n1 --format="%<(42" >actual &&
+	echo "%<(42" >expected &&
+	test_cmp expected actual
+'
+
 test_done
-- 
2.15.0.319.gb3398b820