{"thread":{"id":"1770","subject":"[PATCH] Fix buffer overflow in ce_flush().","startedAt":"2005-09-11T13:27:47Z","lastAt":"2005-09-11T18:54:23Z","messageCount":5,"participants":["Qingning Huo","Junio C Hamano","Linus Torvalds"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"8289","messageId":"20050911132747.GA26401@mayhq.zapto.org","threadId":"1770","inReplyTo":null,"subject":"[PATCH] Fix buffer overflow in ce_flush().","fromName":"Qingning Huo","fromEmail":"qhuo@mayhq.co.uk","sentAt":"2005-09-11T13:27:47Z","receivedAt":"2005-09-11T13:27:47Z","isPatch":true,"sender":{"key":"qhuo@mayhq.co.uk","avatar":null},"body":"Fix buffer overflow in ce_flush().\n\nAdd a check before appending SHA1 signature to write_buffer,\nflush it first if necessary.\n\n---\n\n read-cache.c |    7 +++++++\n 1 files changed, 7 insertions(+), 0 deletions(-)\n\nca84fa808ba3a314d3d9ea5cfb7b8c2462249ca3\ndiff --git a/read-cache.c b/read-cache.c\n--- a/read-cache.c\n+++ b/read-cache.c\n@@ -462,6 +462,13 @@ static int ce_flush(SHA_CTX *context, in\n \t\tSHA1_Update(context, write_buffer, left);\n \t}\n \n+\t/* Flush first if not enough space for SHA1 signature */\n+\tif (left + 20 > WRITE_BUFFER_SIZE) {\n+\t\tif (write(fd, write_buffer, left) != left)\n+\t\t\treturn -1;\n+\t\tleft = 0;\n+\t}\n+\n \t/* Append the SHA1 signature at the end */\n \tSHA1_Final(write_buffer + left, context);\n \tleft += 20;\n"},{"id":"8301","messageId":"7vd5nftrsm.fsf@assigned-by-dhcp.cox.net","threadId":"1770","inReplyTo":"20050911132747.GA26401@mayhq.zapto.org","subject":"Re: [PATCH] Fix buffer overflow in ce_flush().","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2005-09-11T17:53:13Z","receivedAt":"2005-09-11T17:53:13Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Thanks, will apply.\n"},{"id":"8302","messageId":"Pine.LNX.4.58.0509111050040.3242@g5.osdl.org","threadId":"1770","inReplyTo":"20050911132747.GA26401@mayhq.zapto.org","subject":"Re: [PATCH] Fix buffer overflow in ce_flush().","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-09-11T17:54:45Z","receivedAt":"2005-09-11T17:54:45Z","isPatch":true,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Sun, 11 Sep 2005, Qingning Huo wrote:\n>\n> Fix buffer overflow in ce_flush().\n\nThanks, good find. However, I'd almost prefer the simpler patch below..\n\n\t\tLinus\n\n---\nFix buffer overflow in ce_flush()\n\nQingning Huo <qhuo@mayhq.co.uk> noticed that we migth overflow the write \nbuffer when writing the final SHA1 of the index file. Make sure we have \nenough extra room at the end that we can always add the final checksum to \nthe end of the buffer.\n\nSigned-off-by: Linus Torvalds <torvalds@osdl.org>\n---\ndiff --git a/read-cache.c b/read-cache.c\n--- a/read-cache.c\n+++ b/read-cache.c\n@@ -428,7 +428,7 @@ unmap:\n }\n \n #define WRITE_BUFFER_SIZE 8192\n-static unsigned char write_buffer[WRITE_BUFFER_SIZE];\n+static unsigned char write_buffer[WRITE_BUFFER_SIZE+20];\n static unsigned long write_buffer_len;\n \n static int ce_write(SHA_CTX *context, int fd, void *data, unsigned int len)\n"},{"id":"8314","messageId":"7vpsrfsavy.fsf@assigned-by-dhcp.cox.net","threadId":"1770","inReplyTo":"Pine.LNX.4.58.0509111050040.3242@g5.osdl.org","subject":"Re: [PATCH] Fix buffer overflow in ce_flush().","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2005-09-11T18:43:45Z","receivedAt":"2005-09-11T18:43:45Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Linus Torvalds <torvalds@osdl.org> writes:\n\n> On Sun, 11 Sep 2005, Qingning Huo wrote:\n>>\n>> Fix buffer overflow in ce_flush().\n>\n> Thanks, good find. However, I'd almost prefer the simpler patch below..\n>\n> \t\tLinus\n\nHmph.  I thought ce_flush is not in the fast path so the extra\ncheck would not hurt...\n"},{"id":"8315","messageId":"Pine.LNX.4.58.0509111153490.3242@g5.osdl.org","threadId":"1770","inReplyTo":"7vpsrfsavy.fsf@assigned-by-dhcp.cox.net","subject":"Re: [PATCH] Fix buffer overflow in ce_flush().","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-09-11T18:54:23Z","receivedAt":"2005-09-11T18:54:23Z","isPatch":true,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Sun, 11 Sep 2005, Junio C Hamano wrote:\n> \n> Hmph.  I thought ce_flush is not in the fast path so the extra\n> check would not hurt...\n\nNot a performance issue. A code simplicity issue. \n\n\t\t\tLinus\n"}]}