daemon: fix off-by-one in logging extended attributes

If receive a request like: git-upload-pack /foo.git\0host=localhost we mark the offset of the NUL byte as "len", and then log the bytes after the NUL with a "%.*s" placeholder, using "pktlen - len" as the length, and "line + len + 1" as the start of the string. This is off-by-one, since the start of the string skips past the separating NUL byte, but the adjusted length includes it. Fortunately this doesn't actually read past the end of the buffer, since "%.*s" will stop when it hits a NUL. And regardless of what is in the buffer, packet_read() will always add an extra NUL terminator for safety. As an aside, the git.git client sends an extra NUL after a "host" field, too, so we'd generally hit that one first, not the one added by packet_read(). You can see this in the test output which reports 15 bytes, even though the string has only 14 bytes of visible data. But the point is that even a client sending unusual data could not get us to read past the end of the buffer, so this is purely a cosmetic fix. Reported-by: Michael Haggerty <mhagger@alum.mit.edu> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Jan 24, 2018 at 19:56 UTC 19136be3f874ac265195ef35a8c5ed6c417eaea2
2 files changed +13 -2
daemon.c
+2 -2
@@ -759,8 +759,8 @@ static int execute(void)
759 len = strlen(line);
760 if (pktlen != len)
761 loginfo("Extended attributes (%d bytes) exist <%.*s>",
762 - (int) pktlen - len,
763 - (int) pktlen - len, line + len + 1);
762 + (int) pktlen - len - 1,
763 + (int) pktlen - len - 1, line + len + 1);
764 if (len && line[len-1] == '\n') {
765 line[--len] = 0;
766 pktlen--;
t/t5570-git-daemon.sh
+11
@@ -183,5 +183,16 @@ test_expect_success 'hostname cannot break out of directory' '
183 git ls-remote "$GIT_DAEMON_URL/escape.git"
184 '
185
186 +test_expect_success 'daemon log records hostnames' '
187 + cat >expect <<-\EOF &&
188 + Extended attributes (15 bytes) exist <host=localhost>
189 + EOF
190 + >daemon.log &&
191 + GIT_OVERRIDE_VIRTUAL_HOST=localhost \
192 + git ls-remote "$GIT_DAEMON_URL/interp.git" &&
193 + grep -i extended.attribute daemon.log | cut -d" " -f2- >actual &&
194 + test_cmp expect actual
195 +'
196 +
197 stop_git_daemon
198 test_done