git/list[1] front-page[2] threads[3] people[4] search[5] about
 

avoid atoi, when possible; int overflow -> heap corruption

From
Jim Meyering <jim@meyering.net>
Date
May 22, 2006, 06:57 UTC
Message-ID
<871wumim28.fsf_-_@rho.meyering.net>
In-Reply-To
<7v3bf3jl15.fsf@assigned-by-dhcp.cox.net>

This is another one of those `would be nice' sort of changes. Probably not worth much at this early stage in development, but eventually worth changing.

There are about 20 uses of atoi, and most calls can return a usable result in spite of an invalid input -- just because atoi returns the same thing for "99" as "99-and-any-suffix". It would be better not to ignore invalid inputs.

------------------- Also, integer overflow in object.c can cause trouble. When the xrealloc byte count exceeds 2^32 (for a 32-bit int), xrealloc will happily return a buffer of the requested (small) size, but the following memset will scribble zeroes far beyond the end of that new buffer.

static int nr_objs;
int obj_allocs;
...
void created_object(const unsigned char *sha1, struct object *obj)
{
...
	if (obj_allocs - 1 <= nr_objs * 2) {
		int i, count = obj_allocs;
		obj_allocs = (obj_allocs < 32 ? 32 : 2 * obj_allocs);
		objs = xrealloc(objs, obj_allocs * sizeof(struct object *));
		memset(objs + count, 0, (obj_allocs - count)
				* sizeof(struct object *));

But this may be only theoretical, because the problem doesn't strike until there are over 250M objects (assuming 32-bit int and 8-byte pointers).

Previous: Junio C HamanoNext: Morten Welinder
Message 15 of 20 in “synchronizing incremental git changes to cvs”
  1. Jim MeyeringMay 20, 2006
  2. Johannes SchindelinMay 20, 2006
  3. Jim MeyeringMay 21, 2006
  4. Pavel RoskinMay 22, 2006
  5. Jakub NarebskiMay 22, 2006
  6. Martin LanghoffMay 21, 2006
  7. Jim MeyeringMay 21, 2006
  8. Junio C HamanoMay 21, 2006
  9. Jim MeyeringMay 21, 2006
  10. don't accept bogus N in `HEAD~N'Jim Meyering, May 21, 2006
  11. Jakub NarebskiMay 21, 2006
  12. Jim MeyeringMay 22, 2006
  13. Junio C HamanoMay 22, 2006
  14. Junio C HamanoMay 22, 2006
  15. avoid atoi, when possible; int overflow -> heap corruptionJim Meyering, May 22, 2006
  16. Morten WelinderMay 22, 2006
  17. Jim MeyeringMay 22, 2006
  18. Jeff KingMay 22, 2006
  19. Morten WelinderMay 22, 2006
  20. detect write failure, even for stdoutJim Meyering, May 22, 2006

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.