git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 1/3] ewah_read_mmap: bounds-check mmap reads

From
Junio C Hamano <gitster@pobox.com>
Date
Jun 15, 2018, 16:20 UTC
Message-ID
<xmqq602k2f9o.fsf@gitster-ct.c.googlers.com>
In-Reply-To
<20180615091432.7155-1-szeder.dev@gmail.com>
SZEDER Gábor <szeder.dev@gmail.com> writes:
Show 5 quoted lines
>> +	bitmap=$(ls .git/objects/pack/*.bitmap) &&
>
> I think the 'ls' is unnecessary and this would do:
>
>   bitmap=.git/objects/pack/*.bitmap
Yuck.
>> +	test_when_finished "rm -f $bitmap" &&

OK, this will become "rm -f .git/objects/pack/*.bitmap" and then eval that implements when-finished would make it work OK.

>> +	head -c 512 <$bitmap >$bitmap.tmp &&

The reading side would be OK but would the writing side also be alright?

	makefile=Mak?file
	head -n 4 <$makefile >$makefile.tmp
	/bin/ls -t -1 | head -n 1
        Mak?file.tmp
Hmm...
>> +	mv $bitmap.tmp $bitmap &&
Likewise...

I said "yuck" because the original does not work if there happen to be more than (or for that matter, less than) one '.bitmap' file there. But at least as long as there is one, it should work ;-)

Previous: SZEDER GáborNext: SZEDER Gábor
Message 5 of 58 in “security: potential out-of-bound read at ewah_io.c |ewah_read_mmap|”
  1. Luat NguyenJun 14, 2018
  2. Jeff KingJun 15, 2018
  3. 1/3 ewah_read_mmap: bounds-check mmap readsJeff King, Jun 15, 2018
  4. SZEDER GáborJun 15, 2018
  5. Junio C HamanoJun 15, 2018
  6. SZEDER GáborJun 15, 2018
  7. Jeff KingJun 15, 2018
  8. Junio C HamanoJun 15, 2018
  9. Junio C HamanoJun 15, 2018
  10. Jeff KingJun 15, 2018
  11. Junio C HamanoJun 15, 2018
  12. SZEDER GáborJun 16, 2018
  13. Jeff KingJun 16, 2018
  14. 2/3 ewah: drop ewah_deserialize functionJeff King, Jun 15, 2018
  15. 3/3 ewah: drop ewah_serialize_native functionJeff King, Jun 15, 2018
  16. Ramsay JonesJun 15, 2018
  17. Ramsay JonesJun 15, 2018
  18. 0/8 Delete unused methods in EWAH bitmapDerrick Stolee, Jun 15, 2018
  19. 2/8 ewah/bitmap.c: delete unused 'bitmap_each_bit()'Derrick Stolee, Jun 15, 2018
  20. Ramsay JonesJun 15, 2018
  21. 4/8 ewah_bitmap: delete unused 'ewah_and_not()'Derrick Stolee, Jun 15, 2018
  22. 6/8 ewah_bitmap: delete unused 'ewah_or()'Derrick Stolee, Jun 15, 2018
  23. 8/8 ewah_io: delete unused 'ewah_serialize_native()'Derrick Stolee, Jun 15, 2018
  24. Ramsay JonesJun 15, 2018
  25. Derrick StoleeJun 15, 2018
  26. 1/8 ewah/bitmap.c: delete unused 'bitmap_clear()'Derrick Stolee, Jun 15, 2018
  27. Ramsay JonesJun 15, 2018
  28. Derrick StoleeJun 15, 2018
  29. 7/8 ewah_io: delete unused 'ewah_serialize()'Derrick Stolee, Jun 15, 2018
  30. 3/8 ewah_bitmap: delete unused 'ewah_and()'Derrick Stolee, Jun 15, 2018
  31. 5/8 ewah_bitmap: delete unused 'ewah_not()'Derrick Stolee, Jun 15, 2018
  32. Derrick StoleeJun 15, 2018
  33. 0/7 Delete unused methods in EWAH bitmapDerrick Stolee, Jun 15, 2018
  34. 1/7 ewah/bitmap.c: delete unused 'bitmap_clear()'Derrick Stolee, Jun 15, 2018
  35. 2/7 ewah/bitmap.c: delete unused 'bitmap_each_bit()'Derrick Stolee, Jun 15, 2018
  36. 3/7 ewah_bitmap: delete unused 'ewah_and()'Derrick Stolee, Jun 15, 2018
  37. 4/7 ewah_bitmap: delete unused 'ewah_and_not()'Derrick Stolee, Jun 15, 2018
  38. 7/7 ewah_io: delete unused 'ewah_serialize()'Derrick Stolee, Jun 15, 2018
  39. 5/7 ewah_bitmap: delete unused 'ewah_not()'Derrick Stolee, Jun 15, 2018
  40. 6/7 ewah_bitmap: delete unused 'ewah_or()'Derrick Stolee, Jun 15, 2018
  41. Junio C HamanoJun 15, 2018
  42. Derrick StoleeJun 15, 2018
  43. Junio C HamanoJun 15, 2018
  44. Jeff KingJun 15, 2018
  45. Derrick StoleeJun 15, 2018
  46. Jeff KingJun 15, 2018
  47. Junio C HamanoJun 15, 2018
  48. Jeff KingJun 15, 2018
  49. 4/3 ewah: adjust callers of ewah_read_mmap()Jeff King, Jun 15, 2018
  50. Derrick StoleeJun 15, 2018
  51. Junio C HamanoJun 15, 2018
  52. Jeff KingJun 15, 2018
  53. Derrick StoleeJun 15, 2018
  54. Jeff KingJun 15, 2018
  55. Junio C HamanoJun 15, 2018
  56. Junio C HamanoJun 15, 2018
  57. Dyer, EdwinJun 19, 2018
  58. Jeff KingJun 19, 2018

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.