summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMartin Erik Werner <martinerikwerner@gmail.com>2014-04-24 15:06:09 +0200
committerJunio C Hamano <gitster@pobox.com>2014-04-24 13:46:13 -0700
commit6127ff63cf39471b2c7317c9861016424d3b884b (patch)
tree19b830120ec820d876730960d6d994ba6a017302
parent655ee9ea3e6c0af57d320e84723ec3bf656cdbf7 (diff)
downloadgit-6127ff63cf39471b2c7317c9861016424d3b884b.tar.gz
setup: fix windows path buffer over-steppingmw/symlinks
Fix a buffer over-stepping issue triggered by providing an absolute path that is similar to the work tree path. abspath_part_inside_repo() may currently increment the path pointer by offset_1st_component() + wtlen, which is too much, since offset_1st_component() is a subset of wtlen. For the *nix-style prefix '/', this does (by luck) not cause any issues, since offset_1st_component() is 1 and there will always be a '/' or '\0' that can "absorb" this. In the case of DOS-style prefixes though, the offset_1st_component() is 3 and this can potentially over-step the string buffer. For example if work_tree = "c:/r" path = "c:/rl" Then wtlen is 4, and incrementing the path pointer by (3 + 4) would end up 2 bytes outside a string buffer of length 6. Similarly if work_tree = "c:/r" path = "c:/rl/d/a" Then (since the loop starts by also incrementing the pointer one step), this would mean that the function would miss checking if "c:/rl/d" could be the work_tree, arguably this is unlikely though, since it would only be possible with symlinks on windows. Fix this by simply avoiding to increment by offset_1st_component() and wtlen at the same time. Signed-off-by: Martin Erik Werner <martinerikwerner@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
-rw-r--r--setup.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/setup.c b/setup.c
index 8295ba6bd8..3857b58562 100644
--- a/setup.c
+++ b/setup.c
@@ -29,7 +29,7 @@ static int abspath_part_inside_repo(char *path)
return -1;
wtlen = strlen(work_tree);
len = strlen(path);
- off = 0;
+ off = offset_1st_component(path);
/* check if work tree is already the prefix */
if (wtlen <= len && !strncmp(path, work_tree, wtlen)) {
@@ -45,7 +45,7 @@ static int abspath_part_inside_repo(char *path)
off = wtlen;
}
path0 = path;
- path += offset_1st_component(path) + off;
+ path += off;
/* check each '/'-terminated level */
while (*path) {