undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

prune-packed: use strbuf to avoid having to worry about PATH_MAX

Browse Source 
A/very/long/path/to/.git that becomes exactly PATH_MAX bytes long
after suffixed with /objects/??/??38-hex??, would have overflown
the on-stack pathname[] buffer.

Noticed-by:  Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Junio C Hamano 2013-12-17 10:43:30 -08:00
parent d7aced95cd
commit c235d960cb
1 changed files with 21 additions and 17 deletions

38
builtin/prune-packed.c
View File

@ -10,58 +10,62 @@ static const char * const prune_packed_usage[] = {
static struct progress *progress; static struct progress *progress;
static void prune_dir(int i, DIR *dir, char *pathname, int len, int opts) static void prune_dir(int i, DIR *dir, struct strbuf *pathname, int opts)
{ {
struct dirent *de; struct dirent *de;
char hex[40]; char hex[40];
int top_len = pathname->len;
sprintf(hex, "%02x", i); sprintf(hex, "%02x", i);
while ((de = readdir(dir)) != NULL) { while ((de = readdir(dir)) != NULL) {
unsigned char sha1[20]; unsigned char sha1[20];
if (strlen(de->d_name) != 38) if (strlen(de->d_name) != 38)
continue; continue;
memcpy(hex+2, de->d_name, 38); memcpy(hex + 2, de->d_name, 38);
if (get_sha1_hex(hex, sha1)) if (get_sha1_hex(hex, sha1))
continue; continue;
if (!has_sha1_pack(sha1)) if (!has_sha1_pack(sha1))
continue; continue;
memcpy(pathname + len, de->d_name, 38);
strbuf_add(pathname, de->d_name, 38);
if (opts & PRUNE_PACKED_DRY_RUN) if (opts & PRUNE_PACKED_DRY_RUN)
printf("rm -f %s\n", pathname); printf("rm -f %s\n", pathname->buf);
else else
unlink_or_warn(pathname); unlink_or_warn(pathname->buf);
display_progress(progress, i + 1); display_progress(progress, i + 1);
strbuf_setlen(pathname, top_len);
} }
} }
void prune_packed_objects(int opts) void prune_packed_objects(int opts)
{ {
int i; int i;
static char pathname[PATH_MAX];
const char *dir = get_object_directory(); const char *dir = get_object_directory();
int len = strlen(dir); struct strbuf pathname = STRBUF_INIT;
int top_len;
strbuf_addstr(&pathname, dir);
if (opts & PRUNE_PACKED_VERBOSE) if (opts & PRUNE_PACKED_VERBOSE)
progress = start_progress_delay("Removing duplicate objects", progress = start_progress_delay("Removing duplicate objects",
256, 95, 2); 256, 95, 2);
if (len > PATH_MAX - 42) if (pathname.len && pathname.buf[pathname.len - 1] != '/')
die("impossible object directory"); strbuf_addch(&pathname, '/');
memcpy(pathname, dir, len);
if (len && pathname[len-1] != '/') top_len = pathname.len;
pathname[len++] = '/';
for (i = 0; i < 256; i++) { for (i = 0; i < 256; i++) {
DIR *d; DIR *d;
display_progress(progress, i + 1); display_progress(progress, i + 1);
sprintf(pathname + len, "%02x/", i); strbuf_setlen(&pathname, top_len);
d = opendir(pathname); strbuf_addf(&pathname, "%02x/", i);
d = opendir(pathname.buf);
if (!d) if (!d)
continue; continue;
prune_dir(i, d, pathname, len + 3, opts); prune_dir(i, d, &pathname, opts);
closedir(d); closedir(d);
pathname[len + 2] = '\0'; strbuf_setlen(&pathname, top_len + 2);
rmdir(pathname); rmdir(pathname.buf);
} }
stop_progress(&progress); stop_progress(&progress);
} }