{"thread":{"id":"9799","subject":"[PATCH] git-apply: do not read past the end of buffer","startedAt":"2007-09-06T05:06:15Z","lastAt":"2007-09-06T05:06:15Z","messageCount":1,"participants":["Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"52691","messageId":"7vmyw0e62g.fsf@gitster.siamese.dyndns.org","threadId":"9799","inReplyTo":null,"subject":"[PATCH] git-apply: do not read past the end of buffer","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2007-09-06T05:06:15Z","receivedAt":"2007-09-06T05:06:15Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"When the preimage we are patching is shorter than what the patch\ntext expects, we tried to match the buffer contents at the\n\"original\" line with the fragment in full, without checking we\nhave enough data to match in the preimage.  This caused the size\nof a later memmove() to wrap around and attempt to scribble\nalmost the entire address space.  Not good.\n\nThe code that follows the part this patch touches tries to match\nthe fragment with line offsets.  Curiously, that code does not\nhave the problem --- it guards against reading past the end of\nthe preimage.\n\nSigned-off-by: Junio C Hamano <gitster@pobox.com>\n---\n\n * This is an ancient part of the code; I am somewhat surprised\n   that nobody has ever reported it earlier.\n\n builtin-apply.c         |    3 +-\n t/t4123-apply-shrink.sh |   58 +++++++++++++++++++++++++++++++++++++++++++++++\n 2 files changed, 60 insertions(+), 1 deletions(-)\n create mode 100755 t/t4123-apply-shrink.sh\n\ndiff --git a/builtin-apply.c b/builtin-apply.c\nindex 25b1447..976ec77 100644\n--- a/builtin-apply.c\n+++ b/builtin-apply.c\n@@ -1514,7 +1514,8 @@ static int find_offset(const char *buf, unsigned long size, const char *fragment\n \t}\n \n \t/* Exact line number? */\n-\tif (!memcmp(buf + start, fragment, fragsize))\n+\tif ((start + fragsize <= size) &&\n+\t    !memcmp(buf + start, fragment, fragsize))\n \t\treturn start;\n \n \t/*\ndiff --git a/t/t4123-apply-shrink.sh b/t/t4123-apply-shrink.sh\nnew file mode 100755\nindex 0000000..984157f\n--- /dev/null\n+++ b/t/t4123-apply-shrink.sh\n@@ -0,0 +1,58 @@\n+#!/bin/sh\n+\n+test_description='apply a patch that is larger than the preimage'\n+\n+. ./test-lib.sh\n+\n+cat >F  <<\\EOF\n+1\n+2\n+3\n+4\n+5\n+6\n+7\n+8\n+999999\n+A\n+B\n+C\n+D\n+E\n+F\n+G\n+H\n+I\n+J\n+\n+EOF\n+\n+test_expect_success setup '\n+\n+\tgit add F &&\n+\tmv F G &&\n+\tsed -e \"s/1/11/\" -e \"s/999999/9/\" -e \"s/H/HH/\" <G >F &&\n+\tgit diff >patch &&\n+\tsed -e \"/^\\$/d\" <G >F &&\n+\tgit add F\n+\n+'\n+\n+test_expect_success 'apply should fail gracefully' '\n+\n+\tif git apply --index patch\n+\tthen\n+\t\techo Oops, should not have succeeded\n+\t\tfalse\n+\telse\n+\t\tstatus=$?\n+\t\techo \"Status was $status\"\n+\t\tif test -f .git/index.lock\n+\t\tthen\n+\t\t\techo Oops, should not have crashed\n+\t\t\tfalse\n+\t\tfi\n+\tfi\n+'\n+\n+test_done\n"}]}