Re: git segfault in tag verify (patch included)

Steven Roberts <fenderq@gmail.com> writes:

That is this thing.

        static void parse_gpg_output(struct signature_check *sigc)
        {
                const char *buf = sigc->gpg_status;
                const char *line, *next;
                int i, j;
                int seen_exclusive_status = 0;

                /* Iterate over all lines */
                for (line = buf; *line; line = strchrnul(line+1, '\n')) {
                        while (*line == '\n')
                                line++;
                        /* Skip lines that don't start with GNUPG status */
                        if (!skip_prefix(line, "[GNUPG:] ", &line))
                                continue;

If the GPG output ends with a trailing blank line, we skip and get to the terminating NUL, then find that it does not begin with the "[GNUPG:] " prefix, and hit the continue. We try to scan and look for LF (or stop at the end of the string) for the next round, starting at one past where we are, which is already the terminating NUL. Ouch.

Good finding.

We need your sign-off (see Documentation/SubmittingPatches).

Thanks.

-- >8 --
From: Steven Roberts <fenderq@gmail.com>
Subject: gpg-interface: do not scan past the end of buffer

If the GPG output ends with trailing blank lines, after skipping them over inside the loop to find the terminating NUL at the end, the loop ends up looking for the next line, starting past the end.

---
 gpg-interface.c | 4 ++++
 1 file changed, 4 insertions(+)