diff options
| author | Patrick Steinhardt <ps@pks.im> | 2018-10-29 17:19:58 +0100 |
|---|---|---|
| committer | Patrick Steinhardt <ps@pks.im> | 2018-11-02 13:31:09 +0100 |
| commit | 41863a00f0d811c659c9ba87ae2cc0c3aae5a77f (patch) | |
| tree | 466970f5a6b80a7ab18f1b2e1453d90d884182e0 /src | |
| parent | b5ae83bfac53fa3a17435ebf2fc3b79db8055dae (diff) | |
| download | libgit2-41863a00f0d811c659c9ba87ae2cc0c3aae5a77f.tar.gz | |
strntol: fix out-of-bounds read when skipping leading spaces
The `git__strntol` family of functions accepts leading spaces and will
simply skip them. The skipping will not honor the provided buffer's
length, though, which may lead it to read outside of the provided
buffer's bounds if it is not a simple NUL-terminated string.
Furthermore, if leading space is trimmed, the function will further
advance the pointer but not update the number of remaining bytes, which
may also lead to out-of-bounds reads.
Fix the issue by properly paying attention to the buffer length and
updating it when stripping leading whitespace characters. Add a test
that verifies that we won't read past the provided buffer length.
Diffstat (limited to 'src')
| -rw-r--r-- | src/util.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/util.c b/src/util.c index 52495f752..b191d1a16 100644 --- a/src/util.c +++ b/src/util.c @@ -83,8 +83,11 @@ int git__strntol64(int64_t *result, const char *nptr, size_t nptr_len, const cha /* * White space */ - while (git__isspace(*p)) - p++; + while (nptr_len && git__isspace(*p)) + p++, nptr_len--; + + if (!nptr_len) + goto Return; /* * Sign |