[PATCH v2] Fix buffer overflow in config parser
- From
Thomas Jarosch <thomas.jarosch@intra2net.com>
- Date
- Apr 14, 2009, 21:28 UTC
- Message-ID
- <49E50003.2040907@intra2net.com>
When interpreting a config value, the config parser reads in 1+ space character(s) and puts -one- space character in the buffer as soon as the first non-space character is encountered (if not inside quotes).
Unfortunately the buffer size check lacks the extra space character which gets inserted at the next non-space character, resulting in a crash with a specially crafted config entry.
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> --- config.c | 2 +- t/t1303-wacky-config.sh | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/config.c b/config.c index b76fe4c..2d70398 100644 --- a/config.c +++ b/config.c @@ -51,7 +51,7 @@ static char *parse_value(void) for (;;) { int c = get_next_char(); - if (len >= sizeof(value)) + if (len >= sizeof(value) - 1) return NULL; if (c == '\n') { if (quote) diff --git a/t/t1303-wacky-config.sh b/t/t1303-wacky-config.sh index 1983076..a7d8d25 100755 --- a/t/t1303-wacky-config.sh +++ b/t/t1303-wacky-config.sh @@ -10,7 +10,7 @@ setup() { check() { echo "$2" >expected - git config --get "$1" >actual + git config --get "$1" >actual 2>&1 test_cmp actual expected } @@ -40,4 +40,11 @@ test_expect_success 'make sure git config escapes section names properly' ' check "$SECTION" bar ' +LONG_VALUE=`perl -e 'print "x" x 1023," a"'` +test_expect_success 'do not crash on special long config line' ' + setup && + git config section.key "$LONG_VALUE" && + check section.key "fatal: bad config file line 2 in .git/config" +' + test_done
-- 1.6.1.3