[PATCH] Fix buffer overflow in git-grep

From: Dmitry Potapov <dpotapov@gmail.com>
Date: Jul 16, 2008, 10:15 UTC
Message-ID: <1216203345-18233-1-git-send-email-dpotapov@gmail.com>

If PATH_MAX on your system is smaller than any path stored in the git repository, that can cause memory corruption inside of the grep_tree function used by git-grep.

Signed-off-by: Dmitry Potapov <dpotapov@gmail.com>
---
 builtin-grep.c |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/builtin-grep.c b/builtin-grep.c
index ef29910..530a53d 100644
--- a/builtin-grep.c
+++ b/builtin-grep.c
@@ -441,14 +441,17 @@ static int grep_tree(struct grep_opt *opt, const char **paths,
 	len = strlen(path_buf);
 
 	while (tree_entry(tree, &entry)) {
-		strcpy(path_buf + len, entry.path);
+		int te_len = tree_entry_len(entry.path, entry.sha1);
+		if (len + te_len >= PATH_MAX + tn_len)
+			die ("path too long: %s", path_buf+tn_len);
+		memcpy(path_buf + len, entry.path, te_len);
 
 		if (S_ISDIR(entry.mode))
 			/* Match "abc/" against pathspec to
 			 * decide if we want to descend into "abc"
 			 * directory.
 			 */
-			strcpy(path_buf + len + tree_entry_len(entry.path, entry.sha1), "/");
+			strcpy(path_buf + len + te_len, "/");
 
 		if (!pathspec_matches(paths, down))
 			;

-- 
1.5.6.3.1.gb5587a