# [PATCH] Don't segfault if the given SHA1 name is longer than 40 characters 3 messages from 2006-10-19 to 2006-10-19. Participants: pclouds@gmail.com, Junio C Hamano, Nguyen Thai Ngoc Duy. Thread: https://gitlist.dev/t/5952 ## pclouds@gmail.com, 2006-10-19 01:34 Subject: [PATCH] Don't segfault if the given SHA1 name is longer than 40 characters Message-ID: <20061019013441.GB9379@localhost> URL: https://gitlist.dev/e/20061019013441.GB9379%40localhost ``` Signed-off-by: Nguyễn Thái Ngọc Duy --- sha1_name.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/sha1_name.c b/sha1_name.c index 9b226e3..6ffee22 100644 --- a/sha1_name.c +++ b/sha1_name.c @@ -157,7 +157,7 @@ static int get_short_sha1(const char *na char canonical[40]; unsigned char res[20]; - if (len < MINIMUM_ABBREV) + if (len < MINIMUM_ABBREV || len > 40) return -1; hashclr(res); memset(canonical, 'x', 40); -- 1.4.3.rc2.g0503-dirty ``` ## Junio C Hamano, 2006-10-19 04:13 Subject: Re: [PATCH] Don't segfault if the given SHA1 name is longer than 40 characters Message-ID: <7vwt6xvt7q.fsf@assigned-by-dhcp.cox.net> URL: https://gitlist.dev/e/7vwt6xvt7q.fsf%40assigned-by-dhcp.cox.net In-Reply-To: <20061019013441.GB9379@localhost> ``` pclouds@gmail.com writes: > Signed-off-by: Nguyễn Thái Ngọc Duy > --- > sha1_name.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/sha1_name.c b/sha1_name.c > index 9b226e3..6ffee22 100644 > --- a/sha1_name.c > +++ b/sha1_name.c > @@ -157,7 +157,7 @@ static int get_short_sha1(const char *na > char canonical[40]; > unsigned char res[20]; > > - if (len < MINIMUM_ABBREV) > + if (len < MINIMUM_ABBREV || len > 40) > return -1; > hashclr(res); > memset(canonical, 'x', 40); Thanks. The patch is correct, but it needs a better explanation in the proposed commit log message than just "Don't segfault". get_describe_name() can be fed a string foo-gXXX...XXX with a very looooooooong hexstring. It calls get_short_sha1() without checking if XXX...XXX part is longer than 40-bytes (in which case it cannot be a valid object name). get_sha1_1() has the same problem. Given a hexstring longer than 40-bytes, it calls the function with it because earlier ones such as get_sha1_hex() would reject the input. ``` ## Nguyen Thai Ngoc Duy, 2006-10-19 04:54 Subject: Re: [PATCH] Don't segfault if the given SHA1 name is longer than 40 characters Message-ID: URL: https://gitlist.dev/e/fcaeb9bf0610182154l55de75d1w4a99db608f7f6477%40mail.gmail.com In-Reply-To: <7vwt6xvt7q.fsf@assigned-by-dhcp.cox.net> ``` On 10/19/06, Junio C Hamano wrote: > The patch is correct, but it needs a better explanation in the > proposed commit log message than just "Don't segfault". Well, maybe because I got a segfault when I accidentally pasted an sha1 twice (blame my mouse). I hadn't looked closely enough to the bug. Anyway, you got the bug and obviously have a better explanation than mine. Please fix it with a better explanation. I'll be more explanatory next time. Thank you :-) > get_describe_name() can be fed a string foo-gXXX...XXX with a > very looooooooong hexstring. It calls get_short_sha1() without > checking if XXX...XXX part is longer than 40-bytes (in which > case it cannot be a valid object name). > > get_sha1_1() has the same problem. Given a hexstring longer > than 40-bytes, it calls the function with it because earlier > ones such as get_sha1_hex() would reject the input. -- Duy ```