{"thread":{"id":"11498","subject":"[PATCH] tree-walk: don't parse incorrect entries","startedAt":"2008-01-06T17:21:10Z","lastAt":"2008-01-06T17:21:10Z","messageCount":1,"participants":["Martin Koegler"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"64594","messageId":"11996400703010-git-send-email-mkoegler@auto.tuwien.ac.at","threadId":"11498","inReplyTo":null,"subject":"[PATCH] tree-walk: don't parse incorrect entries","fromName":"Martin Koegler","fromEmail":"mkoegler@auto.tuwien.ac.at","sentAt":"2008-01-06T17:21:10Z","receivedAt":"2008-01-06T17:21:10Z","isPatch":true,"sender":{"key":"mkoegler@auto.tuwien.ac.at","avatar":null},"body":"The current code can access memory outside of the tree\nbuffer in the case of malformed tree entries.\n\nThis patch prevent this by:\n* The rest of the buffer must be at least 24 bytes\n  (at least 1 byte mode, 1 blank, at least one byte path name,\n   1 NUL, 20 bytes sha1).\n* Check that the last NUL (21 bytes before the end) is present.\n  This ensurse, that strlen and get_mode stay within the buffer.\n* The mode may not be empty. We have only to reject a blank at the begin,\n  as the rest is handled by if (c < '0' || c > '7').\n* The blank is ensured by get_mode.\n* The path must contain at least one character.\n\nSigned-off-by: Martin Koegler <mkoegler@auto.tuwien.ac.at>\n---\n tree-walk.c |   10 ++++++++--\n 1 files changed, 8 insertions(+), 2 deletions(-)\n\ndiff --git a/tree-walk.c b/tree-walk.c\nindex 8d4b673..10f21d7 100644\n--- a/tree-walk.c\n+++ b/tree-walk.c\n@@ -7,6 +7,9 @@ static const char *get_mode(const char *str, unsigned int *modep)\n \tunsigned char c;\n \tunsigned int mode = 0;\n \n+\tif (*str == ' ')\n+\t\treturn NULL;\n+\n \twhile ((c = *str++) != ' ') {\n \t\tif (c < '0' || c > '7')\n \t\t\treturn NULL;\n@@ -16,13 +19,16 @@ static const char *get_mode(const char *str, unsigned int *modep)\n \treturn str;\n }\n \n-static void decode_tree_entry(struct tree_desc *desc, const void *buf, unsigned long size)\n+static void decode_tree_entry(struct tree_desc *desc, const char *buf, unsigned long size)\n {\n \tconst char *path;\n \tunsigned int mode, len;\n \n+\tif (size < 24 || buf[size - 21]) \n+\t\tdie(\"corrupt tree file\");\n+\n \tpath = get_mode(buf, &mode);\n-\tif (!path)\n+\tif (!path || !*path)\n \t\tdie(\"corrupt tree file\");\n \tlen = strlen(path) + 1;\n \n-- \n1.4.4.4\n"}]}