git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Segmentation fault found while fuzzing .pack file under 2.7.0.rc3

From
Jonathan Nieder <jrnieder@gmail.com>
Date
Jan 6, 2016, 00:23 UTC
Message-ID
<20160106002333.GA16090@google.com>
In-Reply-To
<20160105152436.GA1205@sigill.intra.peff.net>
Jeff King wrote:
Show 6 quoted lines
> Git packfiles come from two places:
>
>   1. Local maintenance repacks loose and already-packed objects into a
>      new packfile. We trust the local repack process to generate a valid
>      packfile (though the contents of individual objects may be
>      untrusted, of course).

I think we should reconsider such trust. If one user creates a malicious pack, if another user uses read-only git commands to access the repository (after inspecting .git/config to make sure it doesn't contain anything scary) the result should not be arbitrary code execution.

Producing bogus output or aborting is okay; arbitrary code execution less so.

Thanks, Jonathan

Previous: Jeff KingNext: Jeff King
Message 3 of 13 in “Segmentation fault found while fuzzing .pack file under 2.7.0.rc3”
  1. Jacek WielemborekJan 5, 2016
  2. Jeff KingJan 5, 2016
  3. Jonathan NiederJan 6, 2016
  4. Jeff KingJan 6, 2016
  5. Jacek WielemborekJan 6, 2016
  6. Duy NguyenJan 6, 2016
  7. Jacek WielemborekJan 6, 2016
  8. Junio C HamanoJan 7, 2016
  9. Junio C HamanoJan 7, 2016
  10. Jeff KingJan 11, 2016
  11. Jeff KingFeb 24, 2016
  12. Junio C HamanoFeb 24, 2016
  13. Jeff KingFeb 25, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.