undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fast-import: fix buffer overflow in dump_tags

Browse Source 
When creating a new annotated tag, we sprintf the refname
into a static-sized buffer. If we have an absurdly long
tagname, like:

  git init repo &&
  cd repo &&
  git commit --allow-empty -m foo &&
  git tag -m message mytag &&
  git fast-export mytag |
  perl -lpe '/^tag/ and s/mytag/"a" x 8192/e' |
  git fast-import <input

we'll overflow the buffer. We can fix it by using a strbuf.

Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Michael Haggerty <mhagger@alum.mit.edu>
Reviewed-by: Ronnie Sahlberg <sahlberg@google.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Jeff King 2014-08-23 01:32:37 -04:00 committed by Junio C Hamano
parent 3c078b9c86
commit c252785982
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fast-import.c
View File

@ -1730,14 +1730,16 @@ static void dump_tags(void)
static const char *msg = "fast-import"; static const char *msg = "fast-import";
struct tag *t; struct tag *t;
struct ref_lock *lock; struct ref_lock *lock;
char ref_name[PATH_MAX]; struct strbuf ref_name = STRBUF_INIT;
for (t = first_tag; t; t = t->next_tag) { for (t = first_tag; t; t = t->next_tag) {
sprintf(ref_name, "tags/%s", t->name); strbuf_reset(&ref_name);
lock = lock_ref_sha1(ref_name, NULL); strbuf_addf(&ref_name, "tags/%s", t->name);
lock = lock_ref_sha1(ref_name.buf, NULL);
if (!lock || write_ref_sha1(lock, t->sha1, msg) < 0) if (!lock || write_ref_sha1(lock, t->sha1, msg) < 0)
failure |= error("Unable to update %s", ref_name); failure |= error("Unable to update %s", ref_name.buf);
} }
strbuf_release(&ref_name);
} }
static void dump_marks_helper(FILE *f, static void dump_marks_helper(FILE *f,