kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

Fix buffer overflow in prepare_attr_stack 

If PATH_MAX on your system is smaller than a path stored in the git repo,
it may cause the buffer overflow in prepare_attr_stack.

Signed-off-by: Dmitry Potapov <dpotapov@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
maint
Dmitry Potapov 2008-07-16 19:39:55 +04:00 committed by Junio C Hamano
parent fd55a19eb1
commit f66cf96d7c
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
attr.c
View File

@ -459,7 +459,9 @@ static void prepare_attr_stack(const char *path, int dirlen)
{ {
struct attr_stack *elem, *info; struct attr_stack *elem, *info;
int len; int len;
char pathbuf[PATH_MAX]; struct strbuf pathbuf;

strbuf_init(&pathbuf, dirlen+2+strlen(GITATTRIBUTES_FILE));


/* /*
* At the bottom of the attribute stack is the built-in * At the bottom of the attribute stack is the built-in
@ -510,13 +512,14 @@ static void prepare_attr_stack(const char *path, int dirlen)
len = strlen(attr_stack->origin); len = strlen(attr_stack->origin);
if (dirlen <= len) if (dirlen <= len)
break; break;
memcpy(pathbuf, path, dirlen); strbuf_reset(&pathbuf);
memcpy(pathbuf + dirlen, "/", 2); strbuf_add(&pathbuf, path, dirlen);
cp = strchr(pathbuf + len + 1, '/'); strbuf_addch(&pathbuf, '/');
cp = strchr(pathbuf.buf + len + 1, '/');
strcpy(cp + 1, GITATTRIBUTES_FILE); strcpy(cp + 1, GITATTRIBUTES_FILE);
elem = read_attr(pathbuf, 0); elem = read_attr(pathbuf.buf, 0);
*cp = '\0'; *cp = '\0';
elem->origin = strdup(pathbuf); elem->origin = strdup(pathbuf.buf);
elem->prev = attr_stack; elem->prev = attr_stack;
attr_stack = elem; attr_stack = elem;
debug_push(elem); debug_push(elem);