git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH v3] [GSOC] ref-filter: fix read invalid union member bug

From
Junio C Hamano <gitster@pobox.com>
Date
May 10, 2021, 07:21 UTC
Message-ID
<xmqqh7jbqck1.fsf@gitster.g>
In-Reply-To
<pull.949.v3.git.1620487572222.gitgitgadget@gmail.com>
"ZheNing Hu via GitGitGadget" <gitgitgadget@gmail.com> writes:
Show 24 quoted lines
> From: ZheNing Hu <adlternative@gmail.com>
>
> used_atom.u is an union, and it has different members depending on
> what atom the auxiliary data the union part of the "struct
> used_atom" wants to record. At most only one of the members can be
> valid at any one time. Since the code checks u.remote_ref without
> even making sure if the atom is "push" or "push:" (which are only
> two cases that u.remote_ref.push becomes valid), but u.remote_ref
> shares the same storage for other members of the union, the check
> was reading from an invalid member, which was the bug.
>
> Modify the condition here to check whether the atom name
> equals to "push" or starts with "push:", to avoid reading the
> value of invalid member of the union.
>
> Helped-by: Junio C Hamano <gitster@pobox.com>
> Signed-off-by: ZheNing Hu <adlternative@gmail.com>
> ---
>     [GSOC] ref-filter: fix read invalid union member bug
>     
>     Change from last version:
>     Modify the processing method of the condition: check whether the name of
>     the atom equals to "push" or starts with "pushs", which can enhanced
>     security, although it may bring string match overhead.

I do not think this would have much security implication either way. What it buys us is the future-proofing.

I think it is OK to make this change without the enum thing to have it graduate early as a fix to the existing code. The enum thing can come on top.

Will queue.  Thanks.
Previous: ZheNing Hu via GitGitGadgetNext: ZheNing Hu
Message 14 of 31 in “[GSOC] ref-filter: solve bugs caused by enumeration”
  1. [GSOC] ref-filter: solve bugs caused by enumerationZheNing Hu via GitGitGadget, May 5, 2021
  2. Junio C HamanoMay 6, 2021
  3. ZheNing HuMay 6, 2021
  4. Junio C HamanoMay 6, 2021
  5. ZheNing HuMay 6, 2021
  6. Junio C HamanoMay 6, 2021
  7. ZheNing HuMay 6, 2021
  8. Junio C HamanoMay 6, 2021
  9. ZheNing HuMay 7, 2021
  10. Junio C HamanoMay 7, 2021
  11. ZheNing HuMay 7, 2021
  12. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 6, 2021
  13. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 8, 2021
  14. Junio C HamanoMay 10, 2021
  15. ZheNing HuMay 10, 2021
  16. Junio C HamanoMay 10, 2021
  17. ZheNing HuMay 10, 2021
  18. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 10, 2021
  19. Junio C HamanoMay 11, 2021
  20. ZheNing HuMay 11, 2021
  21. Junio C HamanoMay 11, 2021
  22. ZheNing HuMay 11, 2021
  23. Junio C HamanoMay 11, 2021
  24. ZheNing HuMay 11, 2021
  25. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 11, 2021
  26. Junio C HamanoMay 12, 2021
  27. ZheNing HuMay 12, 2021
  28. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 12, 2021
  29. Junio C HamanoMay 12, 2021
  30. ZheNing HuMay 13, 2021
  31. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 13, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.