Re: [PATCH 2/2] fast-import: validate entire ident string

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Jonathan Nieder wrote:

> -		lb = strstr(a + 8, " <");
> -		rb = strstr(a + 8, "> ");
> -		eol = strchr(a + 8, '\n');
> +		n = a + strlen("\nauthor");
> +		lb = strstr(n, " <");
> +		rb = strstr(lb + 2, "> ");
> +		eol = strchr(rb + 2, '\n');
>  		if (!lb || !rb || !eol)
>  			die("invalid commit: %s", use_message);

Err, this will segv when it fails; better to use

	lb = a + strlen("\nauthor ");
	lb = strchrnul(lb, '<');
	rb = strchrnul(lb, '>');
	eol = strchrnul(rb, '\n');
	if (!*lb || !*rb || !*eol)
		die("invalid commit: %s", use_message);

This is even more permissive, but I think that’s okay.

Sorry for the noise.
Jonathan
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]