@matheusbsbs / matheus-bagliano / commits / 1eb281159f

precompose_utf8: use a flex array for d_name

On macOS, git status may abort while reading a directory entry whose UTF-8 name grows past NAME_MAX bytes: __chk_fail_overflow __strlcpy_chk precompose_utf8_readdir read_directory_recursive wt_status_collect cmd_status The precompose wrapper already reallocates dirent_prec_psx for long names, but d_name is declared as char[NAME_MAX + 1]. A fortified libc can still see that declared object size and reject a larger strlcpy bound, even though the allocation was grown. Make d_name a FLEX_ARRAY and size allocations from offsetof(). That matches the actual object layout with the dynamic allocation, so the fortified copy sees a destination whose size can grow with max_name_len. Add a regression test that creates an over-NAME_MAX non-ASCII basename and runs status with core.precomposeunicode enabled. Signed-off-by: Ihar Hrachyshka <ihar.hrachyshka@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ihar Hrachyshka committed Jul 4, 2026 at 19:37 UTC 1eb281159f0f75044e9e45a47d1d34162f3b0032

3 files changed +29 -8

compat/precompose_utf8.c

+8 -4

@@ -19,6 +19,11 @@ typedef char *iconv_ibp;

19 static const char *repo_encoding = "UTF-8";

20 static const char *path_encoding = "UTF-8-MAC";

22 +static size_t dirent_prec_psx_size(size_t max_name_len)

23 +{

24 + return st_add(offsetof(dirent_prec_psx, d_name), max_name_len);

25 +}

26 +

27 static size_t has_non_ascii(const char *s, size_t maxlen, size_t *strlen_c)

28 {

29 const uint8_t *ptr = (const uint8_t *)s;

@@ -110,8 +115,8 @@ const char *precompose_argv_prefix(int argc, const char **argv, const char *pref

115 PREC_DIR *precompose_utf8_opendir(const char *dirname)

116 {

117 PREC_DIR *prec_dir = xmalloc(sizeof(PREC_DIR));

113 - prec_dir->dirent_nfc = xmalloc(sizeof(dirent_prec_psx));

114 - prec_dir->dirent_nfc->max_name_len = sizeof(prec_dir->dirent_nfc->d_name);

118 + prec_dir->dirent_nfc = xmalloc(dirent_prec_psx_size(NAME_MAX + 1));

119 + prec_dir->dirent_nfc->max_name_len = NAME_MAX + 1;

120

121 prec_dir->dirp = opendir(dirname);

122 if (!prec_dir->dirp) {

@@ -139,8 +144,7 @@ struct dirent_prec_psx *precompose_utf8_readdir(PREC_DIR *prec_dir)

144 int ret_errno = errno;

145

146 if (new_maxlen > prec_dir->dirent_nfc->max_name_len) {

142 - size_t new_len = sizeof(dirent_prec_psx) + new_maxlen -

143 - sizeof(prec_dir->dirent_nfc->d_name);

147 + size_t new_len = dirent_prec_psx_size(new_maxlen);

148

149 prec_dir->dirent_nfc = xrealloc(prec_dir->dirent_nfc, new_len);

150 prec_dir->dirent_nfc->max_name_len = new_maxlen;

compat/precompose_utf8.h

+5 -4

@@ -14,11 +14,12 @@ typedef struct dirent_prec_psx {

15 /*

16 * See http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/dirent.h.html

17 - * NAME_MAX + 1 should be enough, but some systems have

18 - * NAME_MAX=255 and strlen(d_name) may return 508 or 510

19 - * Solution: allocate more when needed, see precompose_utf8_readdir()

17 + * Start with room for NAME_MAX + 1 bytes, but keep d_name as a

18 + * flexible array. Some systems have NAME_MAX=255 while strlen(d_name)

19 + * from readdir() may return 508 or 510 bytes. Grow the allocation as

20 + * needed in precompose_utf8_readdir().

21 */

21 - char d_name[NAME_MAX+1];

22 + char d_name[FLEX_ARRAY];

23 } dirent_prec_psx;

t/t3910-mac-os-precompose.sh

+16

@@ -207,6 +207,22 @@ test_expect_success "Add long precomposed filename" '

207 git commit -m "Long filename"

208 '

209

210 +test_expect_success "status with long non-ASCII filename" '

211 + test_when_finished "rm -rf long-utf8-status" &&

212 + git init long-utf8-status &&

213 + (

214 + cd long-utf8-status &&

215 + test "$(git config --bool core.precomposeunicode)" = true &&

216 + long_utf8_name=$(

217 + printf "%253s\342\200\224" "" |

218 + tr " " a

219 + ) &&

220 + test "$(printf "%s" "$long_utf8_name" | wc -c | tr -d " ")" = 256 &&

221 + printf "content\n" >"$long_utf8_name" &&

222 + git status --porcelain=v1 >actual

223 + )

224 +'

225 +

226 test_expect_failure 'handle existing decomposed filenames' '

227 echo content >"verbatim.$Adiarnfd" &&

228 git -c core.precomposeunicode=false add "verbatim.$Adiarnfd" &&