[PATCH] builtin/mv: fix out of bounds write
- From
John Keeping <john@keeping.me.uk>
- Date
- Mar 8, 2014, 18:35 UTC
- Message-ID
- <20140308183501.GH18371@serenity.lan>
- In-Reply-To
- <20140308181218.GG18371@serenity.lan>
When commit a88c915 (mv: move submodules using a gitfile, 2013-07-30) added the submodule_gitfile array, it was not added to the block that enlarges the arrays when we are moving a directory so that we do not have to worry about it being a directory when we perform the actual move. After this, the loop continues over the enlarged set of sources.
Since we assume that submodule_gitfile has size argc, if any of the items in the source directory are submodules we are guaranteed to write beyond the end of submodule_gitfile.
Fix this by realloc'ing submodule_gitfile at the same time as the other arrays.
Reported-by: Guillaume Gelin <contact@ramnes.eu> Signed-off-by: John Keeping <john@keeping.me.uk> --- On Sat, Mar 08, 2014 at 06:12:18PM +0000, John Keeping wrote:
> This fixes it for me:
Here it is as a proper patch.
builtin/mv.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/builtin/mv.c b/builtin/mv.c index 21c46d1..f99c91e 100644 --- a/builtin/mv.c +++ b/builtin/mv.c @@ -179,6 +179,9 @@ int cmd_mv(int argc, const char **argv, const char *prefix) modes = xrealloc(modes, (argc + last - first) * sizeof(enum update_mode)); + submodule_gitfile = xrealloc(submodule_gitfile, + (argc + last - first) + * sizeof(char *)); } dst = add_slash(dst);
-- 1.9.0.6.g037df60.dirty