Re: [PATCH] tree-walk: disallow overflowing modes

From: Junio C Hamano <gitster@pobox.com>
Date: Jan 22, 2023, 16:36 UTC
Message-ID: <xmqqk01esf0j.fsf@gitster.g>
In-Reply-To: <044bdc8f-fdc9-dfd2-6cbb-941513467524@web.de>

René Scharfe <l.s.r@web.de> writes:

> We could be more strict and reject everything that oversteps
> S_IFMT|ALLPERMS, but the latter is not defined everywhere.  But
> permission bits are well-known, so the magic number 07777 should be
> recognizable enough.  Like this?

I do not quite see the reason why we want to be more strict than we already are at this point in the code path. Stricter mode check in reports FSCK_MSG_ZERO_PADDED_FILEMODE and FSCK_MSG_BAD_FILEMODE from "fsck", which I think is probably sufficient.

Avoiding integer wraparound is a good idea, even if it were impossible to induce misparsing of the tree data to lead to any security issues, for the same reason why we check for zero padded filemode, i.e. such a tree mode will allow the same tree object to be given different object names.

Thanks.