# [PATCH] Fix buffer overflow in ce_flush(). 5 messages from 2005-09-11 to 2005-09-11. Participants: Qingning Huo, Junio C Hamano, Linus Torvalds. Thread: https://gitlist.dev/t/1770 ## Qingning Huo, 2005-09-11 13:27 Subject: [PATCH] Fix buffer overflow in ce_flush(). Message-ID: <20050911132747.GA26401@mayhq.zapto.org> URL: https://gitlist.dev/e/20050911132747.GA26401%40mayhq.zapto.org ``` Fix buffer overflow in ce_flush(). Add a check before appending SHA1 signature to write_buffer, flush it first if necessary. --- read-cache.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) ca84fa808ba3a314d3d9ea5cfb7b8c2462249ca3 diff --git a/read-cache.c b/read-cache.c --- a/read-cache.c +++ b/read-cache.c @@ -462,6 +462,13 @@ static int ce_flush(SHA_CTX *context, in SHA1_Update(context, write_buffer, left); } + /* Flush first if not enough space for SHA1 signature */ + if (left + 20 > WRITE_BUFFER_SIZE) { + if (write(fd, write_buffer, left) != left) + return -1; + left = 0; + } + /* Append the SHA1 signature at the end */ SHA1_Final(write_buffer + left, context); left += 20; ``` ## Junio C Hamano, 2005-09-11 17:53 Subject: Re: [PATCH] Fix buffer overflow in ce_flush(). Message-ID: <7vd5nftrsm.fsf@assigned-by-dhcp.cox.net> URL: https://gitlist.dev/e/7vd5nftrsm.fsf%40assigned-by-dhcp.cox.net In-Reply-To: <20050911132747.GA26401@mayhq.zapto.org> ``` Thanks, will apply. ``` ## Linus Torvalds, 2005-09-11 17:54 Subject: Re: [PATCH] Fix buffer overflow in ce_flush(). Message-ID: URL: https://gitlist.dev/e/Pine.LNX.4.58.0509111050040.3242%40g5.osdl.org In-Reply-To: <20050911132747.GA26401@mayhq.zapto.org> ``` On Sun, 11 Sep 2005, Qingning Huo wrote: > > Fix buffer overflow in ce_flush(). Thanks, good find. However, I'd almost prefer the simpler patch below.. Linus --- Fix buffer overflow in ce_flush() Qingning Huo noticed that we migth overflow the write buffer when writing the final SHA1 of the index file. Make sure we have enough extra room at the end that we can always add the final checksum to the end of the buffer. Signed-off-by: Linus Torvalds --- diff --git a/read-cache.c b/read-cache.c --- a/read-cache.c +++ b/read-cache.c @@ -428,7 +428,7 @@ unmap: } #define WRITE_BUFFER_SIZE 8192 -static unsigned char write_buffer[WRITE_BUFFER_SIZE]; +static unsigned char write_buffer[WRITE_BUFFER_SIZE+20]; static unsigned long write_buffer_len; static int ce_write(SHA_CTX *context, int fd, void *data, unsigned int len) ``` ## Junio C Hamano, 2005-09-11 18:43 Subject: Re: [PATCH] Fix buffer overflow in ce_flush(). Message-ID: <7vpsrfsavy.fsf@assigned-by-dhcp.cox.net> URL: https://gitlist.dev/e/7vpsrfsavy.fsf%40assigned-by-dhcp.cox.net In-Reply-To: ``` Linus Torvalds writes: > On Sun, 11 Sep 2005, Qingning Huo wrote: >> >> Fix buffer overflow in ce_flush(). > > Thanks, good find. However, I'd almost prefer the simpler patch below.. > > Linus Hmph. I thought ce_flush is not in the fast path so the extra check would not hurt... ``` ## Linus Torvalds, 2005-09-11 18:54 Subject: Re: [PATCH] Fix buffer overflow in ce_flush(). Message-ID: URL: https://gitlist.dev/e/Pine.LNX.4.58.0509111153490.3242%40g5.osdl.org In-Reply-To: <7vpsrfsavy.fsf@assigned-by-dhcp.cox.net> ``` On Sun, 11 Sep 2005, Junio C Hamano wrote: > > Hmph. I thought ce_flush is not in the fast path so the extra > check would not hurt... Not a performance issue. A code simplicity issue. Linus ```