[PATCH] pretty: fix buffer over-read with %> and %<
- From
- mwnx <mwnx@gmx.com>
- Date
- Nov 29, 2017, 00:32 UTC
- Message-ID
- <20171129003251.1981-1-mwnx@gmx.com>
A buffer over-read of the format string would occur with unterminated formats of the form '%>(#' and '%<(#', where '#' represents a number.
This error can be witnessed by running git log under valgrind like so:
valgrind git log -n1 --format='%<(42'
This was due to the fact that the "not found" case for strcspn() was being checked in the same way that one checks the "not found" case for strchr(), i.e. by checking for a NULL pointer return value. Instead, one must check for the end of the string since strcspn() points to the character where it finished its search (which will be a '\0' if unsuccessful).
Signed-off-by: Maxwell Nixie <mwnx@gmx.com> --- Hope I got everything right.
pretty.c | 2 +- t/t4205-log-pretty-formats.sh | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/pretty.c b/pretty.c index 2f6b0ae6c..4c70bad45 100644 --- a/pretty.c +++ b/pretty.c @@ -1021,7 +1021,7 @@ static size_t parse_padding_placeholder(struct strbuf *sb, const char *end = start + strcspn(start, ",)"); char *next; int width; - if (!end || end == start) + if (!*end || end == start) return 0; width = strtol(start, &next, 10); if (next == start || width == 0) diff --git a/t/t4205-log-pretty-formats.sh b/t/t4205-log-pretty-formats.sh index 591f35daa..4d9555962 100755 --- a/t/t4205-log-pretty-formats.sh +++ b/t/t4205-log-pretty-formats.sh @@ -598,4 +598,10 @@ test_expect_success ':only and :unfold work together' ' test_cmp expect actual ' +test_expect_success 'unterminated alignment formatting' ' + git log -n1 --format="%<(42" >actual && + echo "%<(42" >expected && + test_cmp expected actual +' + test_done
-- 2.15.0.319.gb3398b820