From: Ramkumar Ramachandra Date: Sun, 14 Aug 2011 08:33:04 GMT Subject: [PATCH 2/7] revert: Fix buffer overflow in insn sheet parser Message-ID: <1313310789-10216-3-git-send-email-artagnon@gmail.com> In-Reply-To: <1313310789-10216-1-git-send-email-artagnon@gmail.com> Check that the commit name argument to a "pick" or "revert" action in '.git/sequencer/todo' is not too long, to avoid overflowing an on-stack buffer. This fixes a regression introduced by a037033b (revert: Introduce --continue to continue the operation, 2011-07-27). Reported-by: Jonathan Nieder Acked-by: Jonathan Nieder Signed-off-by: Ramkumar Ramachandra --- builtin/revert.c | 2 +- t/t3510-cherry-pick-sequence.sh | 11 +++++++++++ 2 files changed, 12 insertions(+), 1 deletions(-) diff --git a/builtin/revert.c b/builtin/revert.c index 8a35bfd..8d29003 100644 --- a/builtin/revert.c +++ b/builtin/revert.c @@ -712,7 +712,7 @@ static struct commit *parse_insn_line(char *start, struct replay_opts *opts) return NULL; q = strchr(p, ' '); - if (!q) + if (!q || q - p + 1 > sizeof(sha1_abbrev)) return NULL; q++; diff --git a/t/t3510-cherry-pick-sequence.sh b/t/t3510-cherry-pick-sequence.sh index 3bca2b3..6882acb 100755 --- a/t/t3510-cherry-pick-sequence.sh +++ b/t/t3510-cherry-pick-sequence.sh @@ -211,4 +211,15 @@ test_expect_success 'malformed instruction sheet 2' ' test_must_fail git cherry-pick --continue ' +test_expect_success 'malformed instruction sheet 3' ' + pristine_detach initial && + test_must_fail git cherry-pick base..anotherpick && + echo "resolved" >foo && + git add foo && + git commit && + sed "s/pick \([0-9a-f]\+\)\(.*\)/pick \1\1\1\1\1\1\1\1\2/" .git/sequencer/todo >new_sheet && + cp new_sheet .git/sequencer/todo && + test_must_fail git cherry-pick --continue +' + test_done -- 1.7.6.351.gb35ac.dirty