git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH v4 6/8] dir: fix checks on common prefix directory

From
Jeff King <peff@peff.net>
Date
Dec 20, 2019, 21:15 UTC
Message-ID
<20191220211525.GC2752079@coredump.intra.peff.net>
In-Reply-To
<xmqqlfr6anbi.fsf@gitster-ct.c.googlers.com>
On Fri, Dec 20, 2019 at 10:01:21AM -0800, Junio C Hamano wrote:
Show 7 quoted lines
> In the meantime, here is to apologize for merging the patch a bit
> too early to 'next'.
> 
> -- >8 --
> From: Junio C Hamano <gitster@pobox.com>
> Date: Fri, 20 Dec 2019 09:55:53 -0800
> Subject: [PATCH] dir.c: use st_add3() for allocation size

Thanks, I think this is an easy improvement worth doing (I laid out more in my response to Elijah, but: I don't think this is exploitable, but I'd rather err on the side of caution and ease of auditing).

-Peff
Previous: Junio C HamanoNext: Elijah Newren via GitGitGadget
Message 58 of 69 in “Directory traversal bugs”
  1. 0/8 Directory traversal bugsElijah Newren via GitGitGadget, Dec 9, 2019
  2. 2/8 Revert "dir.c: make 'git-status --ignored' work within leading directories"Elijah Newren via GitGitGadget, Dec 9, 2019
  3. Denton LiuDec 9, 2019
  4. Elijah NewrenDec 9, 2019
  5. Eric SunshineDec 9, 2019
  6. 3/8 dir: remove stray quote character in commentElijah Newren via GitGitGadget, Dec 9, 2019
  7. 5/8 dir: break part of read_directory_recursive() out for reuseElijah Newren via GitGitGadget, Dec 9, 2019
  8. 7/8 dir: synchronize treat_leading_path() and read_directory_recursive()Elijah Newren via GitGitGadget, Dec 9, 2019
  9. 8/8 dir: consolidate similar code in treat_directory()Elijah Newren via GitGitGadget, Dec 9, 2019
  10. 6/8 dir: fix checks on common prefix directoryElijah Newren via GitGitGadget, Dec 9, 2019
  11. 4/8 dir: exit before wildcard fall-through if there is no wildcardElijah Newren via GitGitGadget, Dec 9, 2019
  12. 1/8 t3011: demonstrate directory traversal failuresElijah Newren via GitGitGadget, Dec 9, 2019
  13. Denton LiuDec 9, 2019
  14. 0/8 Directory traversal bugsElijah Newren via GitGitGadget, Dec 10, 2019
  15. 2/8 Revert "dir.c: make 'git-status --ignored' work within leading directories"Elijah Newren via GitGitGadget, Dec 10, 2019
  16. 1/8 t3011: demonstrate directory traversal failuresElijah Newren via GitGitGadget, Dec 10, 2019
  17. 6/8 dir: fix checks on common prefix directoryElijah Newren via GitGitGadget, Dec 10, 2019
  18. Johannes SchindelinDec 15, 2019
  19. Elijah NewrenDec 16, 2019
  20. Elijah NewrenDec 16, 2019
  21. Junio C HamanoDec 16, 2019
  22. Elijah NewrenDec 16, 2019
  23. Junio C HamanoDec 16, 2019
  24. Elijah NewrenDec 16, 2019
  25. Johannes SchindelinDec 17, 2019
  26. Junio C HamanoDec 17, 2019
  27. Johannes SchindelinDec 17, 2019
  28. Junio C HamanoDec 17, 2019
  29. Johannes SchindelinDec 17, 2019
  30. Elijah NewrenDec 17, 2019
  31. Johannes SchindelinDec 17, 2019
  32. Elijah NewrenDec 17, 2019
  33. 3/8 dir: remove stray quote character in commentElijah Newren via GitGitGadget, Dec 10, 2019
  34. 8/8 dir: consolidate similar code in treat_directory()Elijah Newren via GitGitGadget, Dec 10, 2019
  35. 5/8 dir: break part of read_directory_recursive() out for reuseElijah Newren via GitGitGadget, Dec 10, 2019
  36. 4/8 dir: exit before wildcard fall-through if there is no wildcardElijah Newren via GitGitGadget, Dec 10, 2019
  37. 7/8 dir: synchronize treat_leading_path() and read_directory_recursive()Elijah Newren via GitGitGadget, Dec 10, 2019
  38. 0/3 Directory traversal bugsElijah Newren via GitGitGadget, Dec 17, 2019
  39. 2/3 dir: remove stray quote character in commentElijah Newren via GitGitGadget, Dec 17, 2019
  40. 3/3 dir: exit before wildcard fall-through if there is no wildcardElijah Newren via GitGitGadget, Dec 17, 2019
  41. 1/3 t3011: demonstrate directory traversal failuresElijah Newren via GitGitGadget, Dec 17, 2019
  42. Johannes SchindelinDec 17, 2019
  43. Junio C HamanoDec 17, 2019
  44. Johannes SchindelinDec 21, 2019
  45. 0/8 Directory traversal bugsElijah Newren via GitGitGadget, Dec 18, 2019
  46. 2/8 Revert "dir.c: make 'git-status --ignored' work within leading directories"Elijah Newren via GitGitGadget, Dec 18, 2019
  47. 1/8 t3011: demonstrate directory traversal failuresElijah Newren via GitGitGadget, Dec 18, 2019
  48. 3/8 dir: remove stray quote character in commentElijah Newren via GitGitGadget, Dec 18, 2019
  49. 4/8 dir: exit before wildcard fall-through if there is no wildcardElijah Newren via GitGitGadget, Dec 18, 2019
  50. 5/8 dir: break part of read_directory_recursive() out for reuseElijah Newren via GitGitGadget, Dec 18, 2019
  51. 6/8 dir: fix checks on common prefix directoryElijah Newren via GitGitGadget, Dec 18, 2019
  52. Junio C HamanoDec 18, 2019
  53. Elijah NewrenDec 19, 2019
  54. Jeff KingDec 19, 2019
  55. Elijah NewrenDec 20, 2019
  56. Jeff KingDec 20, 2019
  57. Junio C HamanoDec 20, 2019
  58. Jeff KingDec 20, 2019
  59. 8/8 dir: consolidate similar code in treat_directory()Elijah Newren via GitGitGadget, Dec 18, 2019
  60. 7/8 dir: synchronize treat_leading_path() and read_directory_recursive()Elijah Newren via GitGitGadget, Dec 18, 2019
  61. 0/8 Directory traversal bugsElijah Newren via GitGitGadget, Dec 19, 2019
  62. 1/8 t3011: demonstrate directory traversal failuresElijah Newren via GitGitGadget, Dec 19, 2019
  63. 5/8 dir: break part of read_directory_recursive() out for reuseElijah Newren via GitGitGadget, Dec 19, 2019
  64. 4/8 dir: exit before wildcard fall-through if there is no wildcardElijah Newren via GitGitGadget, Dec 19, 2019
  65. 3/8 dir: remove stray quote character in commentElijah Newren via GitGitGadget, Dec 19, 2019
  66. 2/8 Revert "dir.c: make 'git-status --ignored' work within leading directories"Elijah Newren via GitGitGadget, Dec 19, 2019
  67. 6/8 dir: fix checks on common prefix directoryElijah Newren via GitGitGadget, Dec 19, 2019
  68. 8/8 dir: consolidate similar code in treat_directory()Elijah Newren via GitGitGadget, Dec 19, 2019
  69. 7/8 dir: synchronize treat_leading_path() and read_directory_recursive()Elijah Newren via GitGitGadget, Dec 19, 2019

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.