Go to file
Patrick Steinhardt b49f309aa1 pretty: fix out-of-bounds read when left-flushing with stealing
With the `%>>(<N>)` pretty formatter, you can ask git-log(1) et al to
steal spaces. To do so we need to look ahead of the next token to see
whether there are spaces there. This loop takes into account ANSI
sequences that end with an `m`, and if it finds any it will skip them
until it finds the first space. While doing so it does not take into
account the buffer's limits though and easily does an out-of-bounds
read.

Add a test that hits this behaviour. While we don't have an easy way to
verify this, the test causes the following failure when run with
`SANITIZE=address`:

    ==37941==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000baf at pc 0x55ba6f88e0d0 bp 0x7ffc84c50d20 sp 0x7ffc84c50d10
    READ of size 1 at 0x603000000baf thread T0
        #0 0x55ba6f88e0cf in format_and_pad_commit pretty.c:1712
        #1 0x55ba6f88e7b4 in format_commit_item pretty.c:1801
        #2 0x55ba6f9b1ae4 in strbuf_expand strbuf.c:429
        #3 0x55ba6f88f020 in repo_format_commit_message pretty.c:1869
        #4 0x55ba6f890ccf in pretty_print_commit pretty.c:2161
        #5 0x55ba6f7884c8 in show_log log-tree.c:781
        #6 0x55ba6f78b6ba in log_tree_commit log-tree.c:1117
        #7 0x55ba6f40fed5 in cmd_log_walk_no_free builtin/log.c:508
        #8 0x55ba6f41035b in cmd_log_walk builtin/log.c:549
        #9 0x55ba6f4131a2 in cmd_log builtin/log.c:883
        #10 0x55ba6f2ea993 in run_builtin git.c:466
        #11 0x55ba6f2eb397 in handle_builtin git.c:721
        #12 0x55ba6f2ebb07 in run_argv git.c:788
        #13 0x55ba6f2ec8a7 in cmd_main git.c:923
        #14 0x55ba6f581682 in main common-main.c:57
        #15 0x7f2d08c3c28f  (/usr/lib/libc.so.6+0x2328f)
        #16 0x7f2d08c3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #17 0x55ba6f2e60e4 in _start ../sysdeps/x86_64/start.S:115

    0x603000000baf is located 1 bytes to the left of 24-byte region [0x603000000bb0,0x603000000bc8)
    allocated by thread T0 here:
        #0 0x7f2d08ebe7ea in __interceptor_realloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:85
        #1 0x55ba6fa5b494 in xrealloc wrapper.c:136
        #2 0x55ba6f9aefdc in strbuf_grow strbuf.c:99
        #3 0x55ba6f9b0a06 in strbuf_add strbuf.c:298
        #4 0x55ba6f9b1a25 in strbuf_expand strbuf.c:418
        #5 0x55ba6f88f020 in repo_format_commit_message pretty.c:1869
        #6 0x55ba6f890ccf in pretty_print_commit pretty.c:2161
        #7 0x55ba6f7884c8 in show_log log-tree.c:781
        #8 0x55ba6f78b6ba in log_tree_commit log-tree.c:1117
        #9 0x55ba6f40fed5 in cmd_log_walk_no_free builtin/log.c:508
        #10 0x55ba6f41035b in cmd_log_walk builtin/log.c:549
        #11 0x55ba6f4131a2 in cmd_log builtin/log.c:883
        #12 0x55ba6f2ea993 in run_builtin git.c:466
        #13 0x55ba6f2eb397 in handle_builtin git.c:721
        #14 0x55ba6f2ebb07 in run_argv git.c:788
        #15 0x55ba6f2ec8a7 in cmd_main git.c:923
        #16 0x55ba6f581682 in main common-main.c:57
        #17 0x7f2d08c3c28f  (/usr/lib/libc.so.6+0x2328f)
        #18 0x7f2d08c3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #19 0x55ba6f2e60e4 in _start ../sysdeps/x86_64/start.S:115

    SUMMARY: AddressSanitizer: heap-buffer-overflow pretty.c:1712 in format_and_pad_commit
    Shadow bytes around the buggy address:
      0x0c067fff8120: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
      0x0c067fff8130: fd fd fa fa fd fd fd fd fa fa fd fd fd fa fa fa
      0x0c067fff8140: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
      0x0c067fff8150: fa fa fd fd fd fd fa fa 00 00 00 fa fa fa fd fd
      0x0c067fff8160: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
    =>0x0c067fff8170: fd fd fd fa fa[fa]00 00 00 fa fa fa 00 00 00 fa
      0x0c067fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb

Luckily enough, this would only cause us to copy the out-of-bounds data
into the formatted commit in case we really had an ANSI sequence
preceding our buffer. So this bug likely has no security consequences.

Fix it regardless by not traversing past the buffer's start.

Reported-by: Patrick Steinhardt <ps@pks.im>
Reported-by: Eric Sesterhenn <eric.sesterhenn@x41-dsec.de>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
.github Merge branch 'tb/ci-run-cocci-with-18.04' into maint 2021-02-11 13:57:36 -08:00
Documentation Git 2.30.6 2022-10-06 17:38:16 -04:00
block-sha1
builtin builtin/clone.c: disallow `--local` clones with symlinks 2022-10-01 00:23:38 -04:00
ci ci/install-depends: attempt to fix "brew cask" stuff 2021-01-14 19:08:56 -08:00
compat Add a function to determine whether a path is owned by the current user 2022-03-21 13:16:26 +01:00
contrib Merge branch 'js/cmake-extra-built-ins-fix' 2020-12-14 10:21:38 -08:00
ewah
git-gui Merge https://github.com/prati0100/git-gui 2020-12-18 15:07:10 -08:00
gitk-git
gitweb gitweb/Makefile: conditionally include ../GIT-VERSION-FILE 2020-12-08 16:56:56 -08:00
mergetools
negotiator
perl
po l10n: zh_CN: for git v2.30.0 l10n round 1 and 2 2020-12-27 19:23:27 +08:00
ppc
refs refs/files-backend: don't peek into `struct lock_file` 2021-01-06 13:53:32 -08:00
sha1collisiondetection@855827c583
sha1dc
sha256
t pretty: fix out-of-bounds read when left-flushing with stealing 2022-12-09 14:26:21 +09:00
templates
trace2
vcs-svn
xdiff
.cirrus.yml
.clang-format
.editorconfig
.gitattributes
.gitignore Merge branch 'fc/random-cleanup' 2020-12-08 15:11:21 -08:00
.gitmodules
.mailmap
.travis.yml
.tsan-suppressions
CODE_OF_CONDUCT.md
COPYING
GIT-VERSION-GEN Git 2.30.6 2022-10-06 17:38:16 -04:00
INSTALL doc: mention Python 3.x supports 2020-12-14 15:01:03 -08:00
LGPL-2.1
Makefile Merge branch 'js/skip-dashed-built-ins-from-config-mak' into maint 2021-02-05 16:31:28 -08:00
README.md
RelNotes Git 2.30.6 2022-10-06 17:38:16 -04:00
abspath.c
aclocal.m4
add-interactive.c Merge branch 'js/add-i-color-fix' 2020-12-08 15:11:17 -08:00
add-interactive.h
add-patch.c Merge branch 'js/add-i-color-fix' 2020-12-08 15:11:17 -08:00
advice.c
advice.h
alias.c alias.c: reject too-long cmdline strings in split_cmdline() 2022-10-01 00:23:38 -04:00
alias.h
alloc.c
alloc.h
apply.c Merge branch 'ab/unreachable-break' 2020-12-18 15:15:18 -08:00
apply.h
archive-tar.c
archive-zip.c
archive.c
archive.h
attr.c
attr.h
banned.h
base85.c
bisect.c
bisect.h
blame.c
blame.h
blob.c
blob.h
bloom.c
bloom.h
branch.c
branch.h
builtin.h
bulk-checkin.c
bulk-checkin.h
bundle.c
bundle.h
cache-tree.c
cache-tree.h
cache.h Sync with 2.29.3 2021-02-12 15:51:12 +01:00
chdir-notify.c
chdir-notify.h
check-builtins.sh
check_bindir
checkout.c
checkout.h
color.c
color.h
column.c
column.h
combine-diff.c
command-list.txt
commit-graph.c commit-graph: don't peek into `struct lock_file` 2021-01-06 13:53:32 -08:00
commit-graph.h
commit-reach.c
commit-reach.h
commit-slab-decl.h
commit-slab-impl.h
commit-slab.h
commit.c
commit.h
common-main.c
config.c Merge branch 'ds/config-literal-value' 2020-12-08 15:11:19 -08:00
config.h
config.mak.dev
config.mak.in
config.mak.uname Merge branch 'rb/nonstop-config-mak-uname-update' 2020-12-18 15:15:18 -08:00
configure.ac
connect.c Merge branch 'jk/forbid-lf-in-git-url' into maint 2021-02-05 16:31:27 -08:00
connect.h
connected.c
connected.h
convert.c
convert.h
copy.c
credential.c
credential.h
csum-file.c
csum-file.h
ctype.c
daemon.c
date.c
decorate.c
decorate.h
delta-islands.c
delta-islands.h
delta.h
detect-compiler
diff-delta.c
diff-lib.c
diff-no-index.c
diff.c Merge branch 'jc/diff-I-status-fix' 2020-12-18 15:15:18 -08:00
diff.h
diffcore-break.c
diffcore-delta.c
diffcore-order.c
diffcore-pickaxe.c
diffcore-rename.c
diffcore.h
dir-iterator.c
dir-iterator.h
dir.c
dir.h
editor.c
entry.c
environment.c
exec-cmd.c
exec-cmd.h
fetch-negotiator.c
fetch-negotiator.h
fetch-pack.c Merge branch 'rs/fetch-pack-invalid-lockfile' 2020-12-08 15:11:20 -08:00
fetch-pack.h
fmt-merge-msg.c
fmt-merge-msg.h
fsck.c Merge branch 'jk/forbid-lf-in-git-url' into maint 2021-02-05 16:31:27 -08:00
fsck.h
fsmonitor.c
fsmonitor.h
fuzz-commit-graph.c
fuzz-pack-headers.c
fuzz-pack-idx.c
generate-cmdlist.sh
generate-configlist.sh
gettext.c gettext.c: remove/reword a mostly-useless comment 2021-01-11 13:07:33 -08:00
gettext.h
git-add--interactive.perl Merge branch 'js/add-i-color-fix' 2020-12-08 15:11:17 -08:00
git-archimport.perl
git-bisect.sh
git-compat-util.h git-compat-util: allow root to access both SUDO_UID and root owned 2022-06-17 14:03:08 -07:00
git-cvsexportcommit.perl
git-cvsimport.perl
git-cvsserver.perl
git-difftool--helper.sh
git-filter-branch.sh
git-instaweb.sh
git-merge-octopus.sh
git-merge-one-file.sh
git-merge-resolve.sh
git-mergetool--lib.sh Merge branch 'pb/mergetool-tool-help-fix' into maint 2021-02-05 16:31:24 -08:00
git-mergetool.sh
git-p4.py Merge branch 'dl/p4-encode-after-kw-expansion' into maint 2021-02-08 14:05:54 -08:00
git-quiltimport.sh
git-rebase--preserve-merges.sh
git-request-pull.sh
git-send-email.perl
git-sh-i18n.sh
git-sh-setup.sh
git-submodule.sh
git-svn.perl
git-web--browse.sh
git.c
git.rc
gpg-interface.c
gpg-interface.h
graph.c
graph.h
grep.c
grep.h
hash.h
hashmap.c
hashmap.h
help.c
help.h
hex.c
http-backend.c
http-fetch.c
http-push.c
http-walker.c
http.c
http.h
ident.c
imap-send.c
iterator.h
json-writer.c
json-writer.h
khash.h
kwset.c
kwset.h
levenshtein.c
levenshtein.h
line-log.c
line-log.h
line-range.c
line-range.h
linear-assignment.c
linear-assignment.h
list-objects-filter-options.c
list-objects-filter-options.h
list-objects-filter.c
list-objects-filter.h
list-objects.c
list-objects.h
list.h
ll-merge.c
ll-merge.h
lockfile.c
lockfile.h
log-tree.c
log-tree.h
ls-refs.c
ls-refs.h
mailinfo.c
mailinfo.h
mailmap.c
mailmap.h
match-trees.c
mem-pool.c
mem-pool.h
merge-blobs.c
merge-blobs.h
merge-ort-wrappers.c
merge-ort-wrappers.h
merge-ort.c
merge-ort.h
merge-recursive.c
merge-recursive.h
merge.c
mergesort.c
mergesort.h
midx.c midx: don't peek into `struct lock_file` 2021-01-06 13:53:32 -08:00
midx.h
name-hash.c
notes-cache.c
notes-cache.h
notes-merge.c
notes-merge.h
notes-utils.c
notes-utils.h
notes.c
notes.h
object-store.h
object.c
object.h
oid-array.c oid-array: provide a for-loop iterator 2020-12-07 12:32:04 -08:00
oid-array.h oid-array: provide a for-loop iterator 2020-12-07 12:32:04 -08:00
oidmap.c
oidmap.h
oidset.c
oidset.h
pack-bitmap-write.c
pack-bitmap.c
pack-bitmap.h
pack-check.c
pack-objects.c
pack-objects.h
pack-revindex.c
pack-revindex.h
pack-write.c
pack.h
packfile.c Merge branch 'tb/idx-midx-race-fix' 2020-12-08 15:11:18 -08:00
packfile.h
pager.c
parse-options-cb.c
parse-options.c
parse-options.h parse-options: format argh like error messages 2021-01-06 15:10:27 -08:00
patch-delta.c
patch-ids.c Merge branch 'jk/log-cherry-pick-duplicate-patches' into maint 2021-02-05 16:31:28 -08:00
patch-ids.h patch-ids: handle duplicate hashmap entries 2021-01-12 11:13:32 -08:00
path.c Fix `GIT_CEILING_DIRECTORIES` with `C:\` and the likes 2022-03-24 00:21:08 +01:00
path.h
pathspec.c
pathspec.h
pkt-line.c
pkt-line.h
preload-index.c
pretty.c pretty: fix out-of-bounds read when left-flushing with stealing 2022-12-09 14:26:21 +09:00
pretty.h
prio-queue.c
prio-queue.h
progress.c
progress.h
promisor-remote.c
promisor-remote.h
prompt.c
prompt.h
protocol.c
protocol.h
prune-packed.c
prune-packed.h
quote.c
quote.h
range-diff.c
range-diff.h
reachable.c
reachable.h
read-cache.c read-cache: try not to peek into `struct {lock_,temp}file` 2021-01-06 13:53:32 -08:00
rebase-interactive.c
rebase-interactive.h
rebase.c
rebase.h
ref-filter.c branch: show "HEAD detached" first under reverse sort 2021-01-07 15:13:21 -08:00
ref-filter.h branch: sort detached HEAD based on a flag 2021-01-07 15:13:21 -08:00
reflog-walk.c
reflog-walk.h
refs.c init: provide useful advice about init.defaultBranch 2020-12-13 15:53:51 -08:00
refs.h get_default_branch_name(): prepare for showing some advice 2020-12-13 15:53:50 -08:00
refspec.c Merge branch 'fc/atmark-in-refspec' 2020-12-14 10:21:36 -08:00
refspec.h
remote-curl.c
remote.c Merge branch 'nk/refspecs-negative-fix' 2020-12-23 13:59:46 -08:00
remote.h
replace-object.c
replace-object.h
repo-settings.c
repository.c
repository.h
rerere.c
rerere.h
reset.c
reset.h
resolve-undo.c
resolve-undo.h
revision.c Merge branch 'jk/log-cherry-pick-duplicate-patches' into maint 2021-02-05 16:31:28 -08:00
revision.h
run-command.c Sync with 2.29.3 2021-02-12 15:51:12 +01:00
run-command.h
send-pack.c Merge branch 'js/trace2-session-id' 2020-12-08 15:11:20 -08:00
send-pack.h
sequencer.c
sequencer.h
serve.c
serve.h
server-info.c
setup.c setup: tighten ownership checks post CVE-2022-24765 2022-06-23 12:31:05 +02:00
sh-i18n--envsubst.c
sha1-file.c
sha1-lookup.c
sha1-lookup.h
sha1-name.c
sha1dc_git.c
sha1dc_git.h
shallow.c
shallow.h
shell.c shell: limit size of interactive commands 2022-10-01 00:23:38 -04:00
shortlog.h
sideband.c
sideband.h
sigchain.c
sigchain.h
split-index.c
split-index.h
stable-qsort.c
strbuf.c
strbuf.h
streaming.c
streaming.h
string-list.c
string-list.h
strmap.c
strmap.h strmap: make callers of strmap_remove() to call it in void context 2020-12-15 15:30:44 -08:00
strvec.c
strvec.h
sub-process.c
sub-process.h
submodule-config.c
submodule-config.h
submodule.c submodules: fix of regression on fetching of non-init subsub-repo 2020-12-09 12:32:07 -08:00
submodule.h
symlinks.c Sync with 2.20.5 2021-02-12 15:49:35 +01:00
tag.c
tag.h
tar.h
tempfile.c
tempfile.h
thread-utils.c
thread-utils.h
tmp-objdir.c
tmp-objdir.h
trace.c
trace.h
trace2.c
trace2.h
trailer.c
trailer.h
transport-helper.c
transport-internal.h
transport.c transport: make `protocol.file.allow` be "user" by default 2022-10-01 00:23:38 -04:00
transport.h
tree-diff.c
tree-walk.c
tree-walk.h
tree.c
tree.h
unicode-width.h
unimplemented.sh
unix-socket.c
unix-socket.h
unpack-trees.c Sync with 2.28.1 2021-02-12 15:50:14 +01:00
unpack-trees.h
upload-pack.c Merge branch 'tb/partial-clone-filters-fix' 2020-12-17 15:06:40 -08:00
upload-pack.h
url.c
url.h
urlmatch.c
urlmatch.h
usage.c Merge branch 'jt/trace-error-on-warning' 2020-12-08 15:11:17 -08:00
userdiff.c
userdiff.h
utf8.c
utf8.h
varint.c
varint.h
version.c
version.h
versioncmp.c
walker.c
walker.h
wildmatch.c
wildmatch.h
worktree.c
worktree.h
wrap-for-bin.sh
wrapper.c
write-or-die.c
ws.c
wt-status.c branch: sort detached HEAD based on a flag 2021-01-07 15:13:21 -08:00
wt-status.h branch: sort detached HEAD based on a flag 2021-01-07 15:13:21 -08:00
xdiff-interface.c
xdiff-interface.h
zlib.c

README.md

Build status

Git - fast, scalable, distributed revision control system

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals.

Git is an Open Source project covered by the GNU General Public License version 2 (some parts of it are under different licenses, compatible with the GPLv2). It was originally written by Linus Torvalds with help of a group of hackers around the net.

Please read the file INSTALL for installation instructions.

Many Git online resources are accessible from https://git-scm.com/ including full documentation and Git related tools.

See Documentation/gittutorial.txt to get started, then see Documentation/giteveryday.txt for a useful minimum set of commands, and Documentation/git-<commandname>.txt for documentation of each command. If git has been correctly installed, then the tutorial can also be read with man gittutorial or git help tutorial, and the documentation of each command with man git-<commandname> or git help <commandname>.

CVS users may also want to read Documentation/gitcvs-migration.txt (man gitcvs-migration or git help cvs-migration if git is installed).

The user discussion and development of Git take place on the Git mailing list -- everyone is welcome to post bug reports, feature requests, comments and patches to git@vger.kernel.org (read Documentation/SubmittingPatches for instructions on patch submission). To subscribe to the list, send an email with just "subscribe git" in the body to majordomo@vger.kernel.org. The mailing list archives are available at https://lore.kernel.org/git/, http://marc.info/?l=git and other archival sites.

Issues which are security relevant should be disclosed privately to the Git Security mailing list git-security@googlegroups.com.

The maintainer frequently sends the "What's cooking" reports that list the current status of various development topics to the mailing list. The discussion following them give a good reference for project status, development direction and remaining tasks.

The name "git" was given by Linus Torvalds when he wrote the very first version. He described the tool as "the stupid content tracker" and the name as (depending on your mood):

  • random three-letter combination that is pronounceable, and not actually used by any common UNIX command. The fact that it is a mispronunciation of "get" may or may not be relevant.
  • stupid. contemptible and despicable. simple. Take your pick from the dictionary of slang.
  • "global information tracker": you're in a good mood, and it actually works for you. Angels sing, and a light suddenly fills the room.
  • "goddamn idiotic truckload of sh*t": when it breaks