[PATCH 1/1] get_sha1_hex(): do not read past a NUL character
- From
Michael Haggerty <mhagger@alum.mit.edu>
- Date
- Sep 23, 2011, 13:38 UTC
- Message-ID
- <1316785116-21831-1-git-send-email-mhagger@alum.mit.edu>
- In-Reply-To
- <4E7C857D.8000304@alum.mit.edu>
Previously, get_sha1_hex() would read one character past the end of a null-terminated string whose strlen was an even number less than 40. Although the function correctly returned -1 in these cases, the extra memory access might have been to uninitialized (or even, conceivably, unallocated) memory.
Add a check to avoid reading past the end of a string.
This problem was discovered by Thomas Rast <trast@student.ethz.ch> using valgrind.
Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu> --- It is suggested to apply this bugfix before mh/check-ref-format-3; otherwise the latter triggers the bug, leading to a valgrind error.
This patch could optionally be applied to maint (to which it can be rebased cleanly), though the bug that it fixes is relatively benign.
cache.h | 9 +++++++++ hex.c | 10 +++++++++- 2 files changed, 18 insertions(+), 1 deletions(-)
diff --git cache.h cache.h index 607c2ea..e7bbc0d 100644 --- cache.h +++ cache.h @@ -819,7 +819,16 @@ static inline int get_sha1_with_context(const char *str, unsigned char *sha1, st { return get_sha1_with_context_1(str, sha1, orc, 0, NULL); } + +/* + * Try to read a SHA1 in hexadecimal format from the 40 characters + * starting at hex. Write the 20-byte result to sha1 in binary form. + * Return 0 on success. Reading stops if a NUL is encountered in the + * input, so it is safe to pass this function an arbitrary + * null-terminated string. + */ extern int get_sha1_hex(const char *hex, unsigned char *sha1); + extern char *sha1_to_hex(const unsigned char *sha1); /* static buffer result! */ extern int read_ref(const char *filename, unsigned char *sha1); extern const char *resolve_ref(const char *path, unsigned char *sha1, int, int *); diff --git hex.c hex.c index bb402fb..9ebc050 100644 --- hex.c +++ hex.c @@ -39,7 +39,15 @@ int get_sha1_hex(const char *hex, unsigned char *sha1) { int i; for (i = 0; i < 20; i++) { - unsigned int val = (hexval(hex[0]) << 4) | hexval(hex[1]); + unsigned int val; + /* + * hex[1]=='\0' is caught when val is checked below, + * but if hex[0] is NUL we have to avoid reading + * past the end of the string: + */ + if (!hex[0]) + return -1; + val = (hexval(hex[0]) << 4) | hexval(hex[1]); if (val & ~0xff) return -1; *sha1++ = val;
-- 1.7.7.rc2