From: Rene Scharfe Date: Thu, 10 Aug 2006 15:02:36 GMT Subject: [PATCH 7/9] git-verify-pack: buffer overrun paranoia Message-ID: <11552221583008-git-send-email-rene.scharfe@lsrfire.ath.cx> In-Reply-To: <11552221582769-git-send-email-rene.scharfe@lsrfire.ath.cx> Signed-off-by: Rene Scharfe --- verify-pack.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/verify-pack.c b/verify-pack.c index 94fe0f3..1076001 100644 --- a/verify-pack.c +++ b/verify-pack.c @@ -26,6 +26,15 @@ static int verify_one_pack(const char *p len += 4; } + /* + * add_packed_git() uses our buffer (containing "foo.idx") to + * build the pack filename ("foo.pack"). Make sure it fits. + */ + if (len + 1 >= PATH_MAX) { + arg[len - 4] = '\0'; + return error("name too long: %s.pack", arg); + } + pack = add_packed_git(arg, len, 1); if (!pack) return error("packfile %s not found.", arg); -- 1.4.2.rc2.g822a