threads / patch / 1770

patchFix buffer overflow in ce_flush().

Subject: [PATCH] Fix buffer overflow in ce_flush().

## tl;dr

5 messages between Sep 11, 2005 and Sep 11, 2005. Diffs are folded; open one to read it.

replies: 4people: 3as markdown or json

Qingning Huo· Sep 11, 2005, 13:27 UTC · lore
Fix buffer overflow in ce_flush().

Add a check before appending SHA1 signature to write_buffer, flush it first if necessary.

---
 read-cache.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)
ca84fa808ba3a314d3d9ea5cfb7b8c2462249ca3
Show changes to read-cache.c +7 −0
diff --git a/read-cache.c b/read-cache.c
--- a/read-cache.c
+++ b/read-cache.c
@@ -462,6 +462,13 @@ static int ce_flush(SHA_CTX *context, in
 		SHA1_Update(context, write_buffer, left);
 	}
 
+	/* Flush first if not enough space for SHA1 signature */
+	if (left + 20 > WRITE_BUFFER_SIZE) {
+		if (write(fd, write_buffer, left) != left)
+			return -1;
+		left = 0;
+	}
+
 	/* Append the SHA1 signature at the end */
 	SHA1_Final(write_buffer + left, context);
 	left += 20;
Linus Torvalds· Sep 11, 2005, 17:54 UTC · re: Qingning Huo · lore

Re: [PATCH] Fix buffer overflow in ce_flush().

On Sun, 11 Sep 2005, Qingning Huo wrote:
>
> Fix buffer overflow in ce_flush().
Thanks, good find. However, I'd almost prefer the simpler patch below..
		Linus

--- Fix buffer overflow in ce_flush()

Qingning Huo <qhuo@mayhq.co.uk> noticed that we migth overflow the write buffer when writing the final SHA1 of the index file. Make sure we have enough extra room at the end that we can always add the final checksum to the end of the buffer.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
---
Show changes to read-cache.c +1 −1
diff --git a/read-cache.c b/read-cache.c
--- a/read-cache.c
+++ b/read-cache.c
@@ -428,7 +428,7 @@ unmap:
 }
 
 #define WRITE_BUFFER_SIZE 8192
-static unsigned char write_buffer[WRITE_BUFFER_SIZE];
+static unsigned char write_buffer[WRITE_BUFFER_SIZE+20];
 static unsigned long write_buffer_len;
 
 static int ce_write(SHA_CTX *context, int fd, void *data, unsigned int len)
Junio C Hamano· Sep 11, 2005, 18:43 UTC · re: Linus Torvalds · lore

Re: [PATCH] Fix buffer overflow in ce_flush().

Linus Torvalds <torvalds@osdl.org> writes:
Show 7 quoted lines
> On Sun, 11 Sep 2005, Qingning Huo wrote:
>>
>> Fix buffer overflow in ce_flush().
>
> Thanks, good find. However, I'd almost prefer the simpler patch below..
>
> 		Linus

Hmph. I thought ce_flush is not in the fast path so the extra check would not hurt...

Linus Torvalds· Sep 11, 2005, 18:54 UTC · re: Junio C Hamano · lore

Re: [PATCH] Fix buffer overflow in ce_flush().

On Sun, 11 Sep 2005, Junio C Hamano wrote:
> 
> Hmph.  I thought ce_flush is not in the fast path so the extra
> check would not hurt...
Not a performance issue. A code simplicity issue. 
			Linus

← back to recent threads