Re: [PATCH v3 2/2] builtin/blame: fix out-of-bounds write with blank boundary commits

From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Jan 10, 2025, 13:00 UTC
Message-ID: <992502eb-5131-228e-1915-a35038211f4b@gmx.de>
In-Reply-To: <20250110-b4-pks-blame-truncate-hash-length-v3-2-e61f25b68f30@pks.im>

Hi Patrick,

On Fri, 10 Jan 2025, Patrick Steinhardt wrote:

Show 13 quoted lines

> diff --git a/builtin/blame.c b/builtin/blame.c
> index d7630ac89cb7bd6e9ce5d72c6a98aa433b3b12da..7555c445abe7ca2fa54670ac8fee1d95a6dbafe3 100644
> --- a/builtin/blame.c
> +++ b/builtin/blame.c
> @@ -489,9 +489,9 @@ static void emit_other(struct blame_scoreboard *sb, struct blame_entry *ent, int
>  			fputs(color, stdout);
>
>  		if (suspect->commit->object.flags & UNINTERESTING) {
> -			if (blank_boundary)
> -				memset(hex, ' ', length);
> -			else if (!(opt & OUTPUT_ANNOTATE_COMPAT)) {
> +			if (blank_boundary) {
> +				memset(hex, ' ', strlen(hex));

Using `strlen()` is a neat trick.

I could have done without slipping in a style change (introducing curlies), but the most important thing is that it fixes the bug.

Thank you, Johannes

> +			} else if (!(opt & OUTPUT_ANNOTATE_COMPAT)) {
>  				length--;
>  				putchar('^');
>  			}