[PATCH v2] link_alt_odb_entry: fix read over array bounds reported by valgrind

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



pfxlen can be longer than the path in objdir when relative_base contains
the path to Git's object directory.

Signed-off-by: Heiko Voigt <hvoigt@xxxxxxxxxx>
---

On Sun, Jul 29, 2012 at 05:54:02PM -0700, Junio C Hamano wrote:
> Heiko Voigt <hvoigt@xxxxxxxxxx> writes:
> 
> > pfxlen can be longer than the path in objdir when relative_base contains
> > the path to gits object directory.
> 
> s/gits/????/ perhaps "Git's", but I am not sure.

Git's is correct.

> > @@ -298,7 +298,8 @@ static int link_alt_odb_entry(const char * entry, int len, const char * relative
> >  			return -1;
> >  		}
> >  	}
> > -	if (!memcmp(ent->base, objdir, pfxlen)) {
> > +	objdirlen = strlen(objdir);
> > +	if (!memcmp(ent->base, objdir, pfxlen > objdirlen ? objdirlen : pfxlen)) {
> 
> The new code tells us to compare up to the shorter length between
> objdir (i.e. path/to/.git/objects) and the given alternate object
> directory (i.e. alt/path/to/.git/objects), but is that really what
> we want?  What happens if the given alternate object directory were
> "path/to/.git/objects-not-quite", with objdir "path/to/.git/objects"?
> 
> They are not the same directory, and this check is about avoiding
> "the common mistake of listing ... object directory itself", no?

You are right. strcmp is the correct solution for this. I tried your
change and it also fixes the error valgrind reported.

 sha1_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sha1_file.c b/sha1_file.c
index 4ccaf7a..af5cfbd 100644
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -298,7 +298,7 @@ static int link_alt_odb_entry(const char * entry, int len, const char * relative
 			return -1;
 		}
 	}
-	if (!memcmp(ent->base, objdir, pfxlen)) {
+	if (!strcmp(ent->base, objdir)) {
 		free(ent);
 		return -1;
 	}
-- 
1.7.12.rc0.24.g3fa2a49
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]