diff options
| author | Thomas Jarosch <thomas.jarosch@intra2net.com> | 2009-04-17 14:05:11 +0200 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2009-04-17 20:59:01 -0700 |
| commit | e0b3cc0dffbc965ffa33155cbdcf8d44716c134c (patch) | |
| tree | b6576c5a1c8415e977c9fb4d1eac2d7a8a2f9dc2 | |
| parent | c6d8f7635f619f6576dccf17c1f1264d2cc37a2a (diff) | |
| download | git-e0b3cc0dffbc965ffa33155cbdcf8d44716c134c.tar.gz | |
Fix buffer overflow in config parser
When interpreting a config value, the config parser reads in 1+ space
character(s) and puts -one- space character in the buffer as soon as
the first non-space character is encountered (if not inside quotes).
Unfortunately the buffer size check lacks the extra space character
which gets inserted at the next non-space character, resulting in
a crash with a specially crafted config entry.
The unit test now uses Java to compile a platform independent
.NET framework to output the test string in C# :o)
Read: Thanks to Johannes Sixt for the correct printf call
which replaces the perl invocation.
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
| -rw-r--r-- | config.c | 2 | ||||
| -rwxr-xr-x | t/t1303-wacky-config.sh | 9 |
2 files changed, 9 insertions, 2 deletions
@@ -51,7 +51,7 @@ static char *parse_value(void) for (;;) { int c = get_next_char(); - if (len >= sizeof(value)) + if (len >= sizeof(value) - 1) return NULL; if (c == '\n') { if (quote) diff --git a/t/t1303-wacky-config.sh b/t/t1303-wacky-config.sh index 1983076c75..080117c6bc 100755 --- a/t/t1303-wacky-config.sh +++ b/t/t1303-wacky-config.sh @@ -10,7 +10,7 @@ setup() { check() { echo "$2" >expected - git config --get "$1" >actual + git config --get "$1" >actual 2>&1 test_cmp actual expected } @@ -40,4 +40,11 @@ test_expect_success 'make sure git config escapes section names properly' ' check "$SECTION" bar ' +LONG_VALUE=$(printf "x%01021dx a" 7) +test_expect_success 'do not crash on special long config line' ' + setup && + git config section.key "$LONG_VALUE" && + check section.key "fatal: bad config file line 2 in .git/config" +' + test_done |