undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'rs/ssh-signing-fix'

Browse Source 
Fixes to recently merged topic.

* rs/ssh-signing-fix:
  gpg-interface: avoid buffer overrun in parse_ssh_output()
  gpg-interface: handle missing " with " gracefully in parse_ssh_output()
This commit is contained in:
Junio C Hamano 2021-11-03 13:32:28 -07:00
commit e890c845b8
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
gpg-interface.c
View File

@ -387,10 +387,6 @@ static void parse_ssh_output(struct signature_check *sigc)
line = to_free = xmemdupz(sigc->output, strcspn(sigc->output, "\n"));
if (skip_prefix(line, "Good \"git\" signature for ", &line)) {
/* Valid signature and known principal */
sigc->result = 'G';
sigc->trust_level = TRUST_FULLY;
/* Search for the last "with" to get the full principal */
principal = line;
do {
@ -398,6 +394,12 @@ static void parse_ssh_output(struct signature_check *sigc)
if (search)
line = search + 1;
} while (search != NULL);
if (line == principal)
goto cleanup;
/* Valid signature and known principal */
sigc->result = 'G';
sigc->trust_level = TRUST_FULLY;
sigc->signer = xmemdupz(principal, line - principal - 1);
} else if (skip_prefix(line, "Good \"git\" signature with ", &line)) {
/* Valid signature, but key unknown */
@ -407,9 +409,9 @@ static void parse_ssh_output(struct signature_check *sigc)
goto cleanup;
}
key = strstr(line, "key");
key = strstr(line, "key ");
if (key) {
sigc->fingerprint = xstrdup(strstr(line, "key") + 4);
sigc->fingerprint = xstrdup(strstr(line, "key ") + 4);
sigc->key = xstrdup(sigc->fingerprint);
} else {
/*