undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

commit: reject overlong UTF-8 sequences

Browse Source 
The commit code accepts pseudo-UTF-8 sequences that encode a character with more
bytes than necessary.  Reject such sequences, since they are not valid UTF-8.

Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
brian m. carlson 2013-07-04 17:20:34 +00:00 committed by Junio C Hamano
parent 28110d4bfc
commit e82bd6cc70
2 changed files with 22 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
commit.c
View File

@ -1240,11 +1240,15 @@ int commit_tree(const struct strbuf *msg, unsigned char *tree,
static int find_invalid_utf8(const char *buf, int len) static int find_invalid_utf8(const char *buf, int len)
{ {
int offset = 0; int offset = 0;
static const unsigned int max_codepoint[] = {
0x7f, 0x7ff, 0xffff, 0x10ffff
};
while (len) { while (len) {
unsigned char c = *buf++; unsigned char c = *buf++;
int bytes, bad_offset; int bytes, bad_offset;
unsigned int codepoint; unsigned int codepoint;
unsigned int min_val, max_val;
len--; len--;
offset++; offset++;
@ -1276,8 +1280,13 @@ static int find_invalid_utf8(const char *buf, int len)
if (len < bytes) if (len < bytes)
return bad_offset; return bad_offset;
/* Place the encoded bits at the bottom of the value. */ /*
* Place the encoded bits at the bottom of the value and compute the
* valid range.
*/
codepoint = (c & 0x7f) >> bytes; codepoint = (c & 0x7f) >> bytes;
min_val = max_codepoint[bytes-1] + 1;
max_val = max_codepoint[bytes];
offset += bytes; offset += bytes;
len -= bytes; len -= bytes;
@ -1290,8 +1299,8 @@ static int find_invalid_utf8(const char *buf, int len)
return bad_offset; return bad_offset;
} while (--bytes); } while (--bytes);
/* No codepoints can ever be allocated beyond U+10FFFF. */ /* Reject codepoints that are out of range for the sequence length. */
if (codepoint > 0x10ffff) if (codepoint < min_val || codepoint > max_val)
return bad_offset; return bad_offset;
/* Surrogates are only for UTF-16 and cannot be encoded in UTF-8. */ /* Surrogates are only for UTF-16 and cannot be encoded in UTF-8. */
if ((codepoint & 0x1ff800) == 0xd800) if ((codepoint & 0x1ff800) == 0xd800)
@ -1308,9 +1317,6 @@ static int find_invalid_utf8(const char *buf, int len)
* *
* If it isn't, it assumes any non-utf8 characters are Latin1, * If it isn't, it assumes any non-utf8 characters are Latin1,
* and does the conversion. * and does the conversion.
*
* Fixme: we should probably also disallow overlong forms.
* But we don't do that currently.
*/ */
static int verify_utf8(struct strbuf *buf) static int verify_utf8(struct strbuf *buf)
{ {

10
t/t3900-i18n-commit.sh
View File

@ -48,6 +48,16 @@ test_expect_success 'UTF-8 invalid characters refused' '
grep "did not conform" "$HOME"/stderr grep "did not conform" "$HOME"/stderr
' '
test_expect_success 'UTF-8 overlong sequences rejected' '
test_when_finished "rm -f $HOME/stderr $HOME/invalid" &&
rm -f "$HOME/stderr" "$HOME/invalid" &&
echo "UTF-8 overlong" >F &&
printf "\340\202\251ommit message\n\nThis is not a space:\300\240\n" \
>"$HOME/invalid" &&
git commit -a -F "$HOME/invalid" 2>"$HOME"/stderr &&
grep "did not conform" "$HOME"/stderr
'
for H in ISO8859-1 eucJP ISO-2022-JP for H in ISO8859-1 eucJP ISO-2022-JP
do do
test_expect_success "$H setup" ' test_expect_success "$H setup" '