threads / patch / 5952

patchDon't segfault if the given SHA1 name is longer than 40 characters

Subject: [PATCH] Don't segfault if the given SHA1 name is longer than 40 characters

## tl;dr

3 messages between Oct 19, 2006 and Oct 19, 2006. Diffs are folded; open one to read it.

replies: 2people: 2as markdown or json

pclouds@gmail.com· Oct 19, 2006, 01:34 UTC · lore

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
---
 sha1_name.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Show changes to sha1_name.c +1 −1

diff --git a/sha1_name.c b/sha1_name.c
index 9b226e3..6ffee22 100644
--- a/sha1_name.c
+++ b/sha1_name.c
@@ -157,7 +157,7 @@ static int get_short_sha1(const char *na
 	char canonical[40];
 	unsigned char res[20];
 
-	if (len < MINIMUM_ABBREV)
+	if (len < MINIMUM_ABBREV || len > 40)
 		return -1;
 	hashclr(res);
 	memset(canonical, 'x', 40);

-- 
1.4.3.rc2.g0503-dirty

Junio C Hamano· Oct 19, 2006, 04:13 UTC · re: pclouds@gmail.com · lore

Re: [PATCH] Don't segfault if the given SHA1 name is longer than 40 characters

pclouds@gmail.com writes:

Show 18 quoted lines

> Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
> ---
>  sha1_name.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/sha1_name.c b/sha1_name.c
> index 9b226e3..6ffee22 100644
> --- a/sha1_name.c
> +++ b/sha1_name.c
> @@ -157,7 +157,7 @@ static int get_short_sha1(const char *na
>  	char canonical[40];
>  	unsigned char res[20];
>  
> -	if (len < MINIMUM_ABBREV)
> +	if (len < MINIMUM_ABBREV || len > 40)
>  		return -1;
>  	hashclr(res);
>  	memset(canonical, 'x', 40);

Thanks.

The patch is correct, but it needs a better explanation in the proposed commit log message than just "Don't segfault".

get_describe_name() can be fed a string foo-gXXX...XXX with a very looooooooong hexstring. It calls get_short_sha1() without checking if XXX...XXX part is longer than 40-bytes (in which case it cannot be a valid object name).

get_sha1_1() has the same problem. Given a hexstring longer than 40-bytes, it calls the function with it because earlier ones such as get_sha1_hex() would reject the input.

Nguyen Thai Ngoc Duy· Oct 19, 2006, 04:54 UTC · re: Junio C Hamano · lore

Re: [PATCH] Don't segfault if the given SHA1 name is longer than 40 characters

On 10/19/06, Junio C Hamano <junkio@cox.net> wrote:

> The patch is correct, but it needs a better explanation in the
> proposed commit log message than just "Don't segfault".

Well, maybe because I got a segfault when I accidentally pasted an sha1 twice (blame my mouse). I hadn't looked closely enough to the bug. Anyway, you got the bug and obviously have a better explanation than mine. Please fix it with a better explanation. I'll be more explanatory next time. Thank you :-)

Show 8 quoted lines

> get_describe_name() can be fed a string foo-gXXX...XXX with a
> very looooooooong hexstring.  It calls get_short_sha1() without
> checking if XXX...XXX part is longer than 40-bytes (in which
> case it cannot be a valid object name).
>
> get_sha1_1() has the same problem.  Given a hexstring longer
> than 40-bytes, it calls the function with it because earlier
> ones such as get_sha1_hex() would reject the input.

-- 
Duy