git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 1/3] ewah_read_mmap: bounds-check mmap reads

From
Jeff King <peff@peff.net>
Date
Jun 16, 2018, 19:14 UTC
Message-ID
<20180616191400.GB8914@sigill.intra.peff.net>
In-Reply-To
<20180616143513.10086-1-szeder.dev@gmail.com>
On Sat, Jun 16, 2018 at 04:35:13PM +0200, SZEDER Gábor wrote:
Show 13 quoted lines
> > +	head -c 512 <$bitmap >$bitmap.tmp &&
> > +	mv $bitmap.tmp $bitmap &&
> 
> This line turns out to be problematic on OSX and ultimately causes the
> test to fail.
> 
> When OSX's 'mv's destination is read-only, it asks whether to replace
> the destination even though in the test its stdin is not a terminal
> (and thus doesn't conform to POSIX[1]).  Since the '.bitmap' file is
> read-only, and since 'mv' obviously doesn't get an affirmative
> response from /dev/null, the original '.bitmap' file is not
> overwritten, the subsequent 'git rev-list' doesn't print any error
> message, and finally 'test_i18ngrep' causes the test to fail.

Right, sorry, I should have remembered that we've run into this before. Using "mv -f" is the standard solution. E.g., c20d4d702f (t1450: use "mv -f" within loose object directory, 2017-01-24).

Junio, can you squash this in to jk/ewah-bounds-check~1?
diff --git a/t/t5310-pack-bitmaps.sh b/t/t5310-pack-bitmaps.sh
index c4ed88030c..b11bc392a8 100755
--- a/t/t5310-pack-bitmaps.sh
+++ b/t/t5310-pack-bitmaps.sh
@@ -338,7 +338,7 @@ test_expect_success 'truncated bitmap fails gracefully' '
 	bitmap=$(ls .git/objects/pack/*.bitmap) &&
 	test_when_finished "rm -f $bitmap" &&
 	head -c 512 <$bitmap >$bitmap.tmp &&
-	mv $bitmap.tmp $bitmap &&
+	mv -f $bitmap.tmp $bitmap &&
 	git rev-list --use-bitmap-index --count --all >actual 2>stderr &&
 	test_cmp expect actual &&
 	test_i18ngrep corrupt stderr

-Peff
Previous: SZEDER GáborNext: Jeff King
Message 13 of 58 in “security: potential out-of-bound read at ewah_io.c |ewah_read_mmap|”
  1. Luat NguyenJun 14, 2018
  2. Jeff KingJun 15, 2018
  3. 1/3 ewah_read_mmap: bounds-check mmap readsJeff King, Jun 15, 2018
  4. SZEDER GáborJun 15, 2018
  5. Junio C HamanoJun 15, 2018
  6. SZEDER GáborJun 15, 2018
  7. Jeff KingJun 15, 2018
  8. Junio C HamanoJun 15, 2018
  9. Junio C HamanoJun 15, 2018
  10. Jeff KingJun 15, 2018
  11. Junio C HamanoJun 15, 2018
  12. SZEDER GáborJun 16, 2018
  13. Jeff KingJun 16, 2018
  14. 2/3 ewah: drop ewah_deserialize functionJeff King, Jun 15, 2018
  15. 3/3 ewah: drop ewah_serialize_native functionJeff King, Jun 15, 2018
  16. Ramsay JonesJun 15, 2018
  17. Ramsay JonesJun 15, 2018
  18. 0/8 Delete unused methods in EWAH bitmapDerrick Stolee, Jun 15, 2018
  19. 2/8 ewah/bitmap.c: delete unused 'bitmap_each_bit()'Derrick Stolee, Jun 15, 2018
  20. Ramsay JonesJun 15, 2018
  21. 4/8 ewah_bitmap: delete unused 'ewah_and_not()'Derrick Stolee, Jun 15, 2018
  22. 6/8 ewah_bitmap: delete unused 'ewah_or()'Derrick Stolee, Jun 15, 2018
  23. 8/8 ewah_io: delete unused 'ewah_serialize_native()'Derrick Stolee, Jun 15, 2018
  24. Ramsay JonesJun 15, 2018
  25. Derrick StoleeJun 15, 2018
  26. 1/8 ewah/bitmap.c: delete unused 'bitmap_clear()'Derrick Stolee, Jun 15, 2018
  27. Ramsay JonesJun 15, 2018
  28. Derrick StoleeJun 15, 2018
  29. 7/8 ewah_io: delete unused 'ewah_serialize()'Derrick Stolee, Jun 15, 2018
  30. 3/8 ewah_bitmap: delete unused 'ewah_and()'Derrick Stolee, Jun 15, 2018
  31. 5/8 ewah_bitmap: delete unused 'ewah_not()'Derrick Stolee, Jun 15, 2018
  32. Derrick StoleeJun 15, 2018
  33. 0/7 Delete unused methods in EWAH bitmapDerrick Stolee, Jun 15, 2018
  34. 1/7 ewah/bitmap.c: delete unused 'bitmap_clear()'Derrick Stolee, Jun 15, 2018
  35. 2/7 ewah/bitmap.c: delete unused 'bitmap_each_bit()'Derrick Stolee, Jun 15, 2018
  36. 3/7 ewah_bitmap: delete unused 'ewah_and()'Derrick Stolee, Jun 15, 2018
  37. 4/7 ewah_bitmap: delete unused 'ewah_and_not()'Derrick Stolee, Jun 15, 2018
  38. 7/7 ewah_io: delete unused 'ewah_serialize()'Derrick Stolee, Jun 15, 2018
  39. 5/7 ewah_bitmap: delete unused 'ewah_not()'Derrick Stolee, Jun 15, 2018
  40. 6/7 ewah_bitmap: delete unused 'ewah_or()'Derrick Stolee, Jun 15, 2018
  41. Junio C HamanoJun 15, 2018
  42. Derrick StoleeJun 15, 2018
  43. Junio C HamanoJun 15, 2018
  44. Jeff KingJun 15, 2018
  45. Derrick StoleeJun 15, 2018
  46. Jeff KingJun 15, 2018
  47. Junio C HamanoJun 15, 2018
  48. Jeff KingJun 15, 2018
  49. 4/3 ewah: adjust callers of ewah_read_mmap()Jeff King, Jun 15, 2018
  50. Derrick StoleeJun 15, 2018
  51. Junio C HamanoJun 15, 2018
  52. Jeff KingJun 15, 2018
  53. Derrick StoleeJun 15, 2018
  54. Jeff KingJun 15, 2018
  55. Junio C HamanoJun 15, 2018
  56. Junio C HamanoJun 15, 2018
  57. Dyer, EdwinJun 19, 2018
  58. Jeff KingJun 19, 2018

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.