Re: [PATCH v5 01/16] reftable: fix OOB stack write in print functions
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Dec 22, 2021, 22:51 UTC
- Message-ID
- <xmqq8rwcfe36.fsf@gitster.g>
- In-Reply-To
- <e7f1be7bbec0427d5c10453631c3486936ed2bf0.1640199396.git.gitgitgadget@gmail.com>
"Han-Wen Nienhuys via GitGitGadget" <gitgitgadget@gmail.com> writes:
Show 29 quoted lines
> From: Han-Wen Nienhuys <hanwen@google.com>
>
> Signed-off-by: Han-Wen Nienhuys <hanwen@google.com>
> ---
> reftable/record.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/reftable/record.c b/reftable/record.c
> index 6a5dac32dc6..8536bd03aa9 100644
> --- a/reftable/record.c
> +++ b/reftable/record.c
> @@ -254,7 +254,7 @@ static void hex_format(char *dest, uint8_t *src, int hash_size)
> void reftable_ref_record_print(struct reftable_ref_record *ref,
> uint32_t hash_id)
> {
> - char hex[2 * GIT_SHA256_RAWSZ + 1] = { 0 }; /* BUG */
> + char hex[GIT_MAX_HEXSZ + 1] = { 0 }; /* BUG */
> printf("ref{%s(%" PRIu64 ") ", ref->refname, ref->update_index);
> switch (ref->value_type) {
> case REFTABLE_REF_SYMREF:
> @@ -586,7 +586,7 @@ static struct reftable_record_vtable reftable_obj_record_vtable = {
> void reftable_log_record_print(struct reftable_log_record *log,
> uint32_t hash_id)
> {
> - char hex[GIT_SHA256_RAWSZ + 1] = { 0 };
> + char hex[GIT_MAX_HEXSZ + 1] = { 0 };
>
> switch (log->value_type) {
> case REFTABLE_LOG_DELETION:Wow. The first one is future-proofing in case we learn to use even larger hash, but the latter is an outright bug that makes reviewers feel embarrassed, isn't it?
Thanks for noticing and fixing it.