From: Michael Haggerty Date: Tue, 17 Dec 2013 13:43:57 GMT Subject: [PATCH 2/3] prune_object_dir(): verify that path fits in the temporary buffer Message-ID: <1387287838-25779-3-git-send-email-mhagger@alum.mit.edu> In-Reply-To: <1387287838-25779-1-git-send-email-mhagger@alum.mit.edu> Dimension the buffer based on PATH_MAX rather than a magic number, and verify that the path fits in it before continuing. Signed-off-by: Michael Haggerty --- I don't think that this problem is remotely exploitable, because the size of the string doesn't depend on inputs that can be influenced by a client (at least not within Git). builtin/prune.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/builtin/prune.c b/builtin/prune.c index 6366917..ae34d04 100644 --- a/builtin/prune.c +++ b/builtin/prune.c @@ -96,7 +96,9 @@ static void prune_object_dir(const char *path) { int i; for (i = 0; i < 256; i++) { - static char dir[4096]; + static char dir[PATH_MAX + 1]; + if (strlen(path) + 3 > PATH_MAX) + die("impossible object directory"); sprintf(dir, "%s/%02x", path, i); prune_dir(i, dir); } -- 1.8.5.1