[PATCH] setup: Fix windows path buffer over-stepping

Martin Erik Werner· Apr 24, 2014, 13:06 UTC · lore

Fix a buffer over-stepping issue triggered by providing an absolute path that is similar to the work tree path.

abspath_part_inside_repo() may currently increment the path pointer by offset_1st_component() + wtlen, which is too much, since offset_1st_component() is a subset of wtlen.

For the *nix-style prefix '/', this does (by luck) not cause any issues, since offset_1st_component() is 1 and there will always be a '/' or '\0' that can "absorb" this.

In the case of DOS-style prefixes though, the offset_1st_component() is 3 and this can potentially over-step the string buffer. For example if

    work_tree = "c:/r"
    path      = "c:/rl"

Then wtlen is 4, and incrementing the path pointer by (3 + 4) would end up 2 bytes outside a string buffer of length 6.

Similarly if

    work_tree = "c:/r"
    path      = "c:/rl/d/a"

Then (since the loop starts by also incrementing the pointer one step), this would mean that the function would miss checking if "c:/rl/d" could be the work_tree, arguably this is unlikely though, since it would only be possible with symlinks on windows.

Fix this by simply avoiding to increment by offset_1st_component() and wtlen at the same time.

Signed-off-by: Martin Erik Werner <martinerikwerner@gmail.com>
---

This is a follow-up on 655ee9e mw/symlinks which is currently merged into master, prospective for git v2.0.0, the issue only affects v2.0.0-rc0.

 setup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Show changes to setup.c +2 −2

diff --git a/setup.c b/setup.c
index 613e3b3..0a22f8b 100644
--- a/setup.c
+++ b/setup.c
@@ -29,7 +29,7 @@ static int abspath_part_inside_repo(char *path)
 		return -1;
 	wtlen = strlen(work_tree);
 	len = strlen(path);
-	off = 0;
+	off = offset_1st_component(path);
 
 	/* check if work tree is already the prefix */
 	if (wtlen <= len && !strncmp(path, work_tree, wtlen)) {
@@ -45,7 +45,7 @@ static int abspath_part_inside_repo(char *path)
 		off = wtlen;
 	}
 	path0 = path;
-	path += offset_1st_component(path) + off;
+	path += off;
 
 	/* check each '/'-terminated level */
 	while (*path) {

-- 
1.9.2

Junio C Hamano· Apr 24, 2014, 18:37 UTC · re: Martin Erik Werner · lore

Re: [PATCH] setup: Fix windows path buffer over-stepping

Martin Erik Werner <martinerikwerner@gmail.com> writes:

Show 38 quoted lines

> Fix a buffer over-stepping issue triggered by providing an absolute path
> that is similar to the work tree path.
>
> abspath_part_inside_repo() may currently increment the path pointer by
> offset_1st_component() + wtlen, which is too much, since
> offset_1st_component() is a subset of wtlen.
>
> For the *nix-style prefix '/', this does (by luck) not cause any issues,
> since offset_1st_component() is 1 and there will always be a '/' or '\0'
> that can "absorb" this.
>
> In the case of DOS-style prefixes though, the offset_1st_component() is
> 3 and this can potentially over-step the string buffer. For example if
>
>     work_tree = "c:/r"
>     path      = "c:/rl"
>
> Then wtlen is 4, and incrementing the path pointer by (3 + 4) would
> end up 2 bytes outside a string buffer of length 6.
>
> Similarly if
>
>     work_tree = "c:/r"
>     path      = "c:/rl/d/a"
>
> Then (since the loop starts by also incrementing the pointer one step),
> this would mean that the function would miss checking if "c:/rl/d" could
> be the work_tree, arguably this is unlikely though, since it would only
> be possible with symlinks on windows.
>
> Fix this by simply avoiding to increment by offset_1st_component() and
> wtlen at the same time.
>
> Signed-off-by: Martin Erik Werner <martinerikwerner@gmail.com>
> ---
>
> This is a follow-up on 655ee9e mw/symlinks which is currently merged into
> master, prospective for git v2.0.0, the issue only affects v2.0.0-rc0.

Thanks for a fix and from a cursory read of the surrounding code, I think the patch makes sense.

I appreciate your doing so before the breakage hits a released version very much.

Show 25 quoted lines

>  setup.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/setup.c b/setup.c
> index 613e3b3..0a22f8b 100644
> --- a/setup.c
> +++ b/setup.c
> @@ -29,7 +29,7 @@ static int abspath_part_inside_repo(char *path)
>  		return -1;
>  	wtlen = strlen(work_tree);
>  	len = strlen(path);
> -	off = 0;
> +	off = offset_1st_component(path);
>  
>  	/* check if work tree is already the prefix */
>  	if (wtlen <= len && !strncmp(path, work_tree, wtlen)) {
> @@ -45,7 +45,7 @@ static int abspath_part_inside_repo(char *path)
>  		off = wtlen;
>  	}
>  	path0 = path;
> -	path += offset_1st_component(path) + off;
> +	path += off;
>  
>  	/* check each '/'-terminated level */
>  	while (*path) {

patchsetup: Fix windows path buffer over-stepping