patch-delta: fix oob read
If `cmd` is in the range [0x01,0x7f] and `cmd > top-data`, the `memcpy(out, data, cmd)` can copy out-of-bounds data from after `delta_buf` into `dst_buf`. This is not an exploitable bug because triggering the bug increments the `data` pointer beyond `top`, causing the `data != top` sanity check after the loop to trigger and discard the destination buffer - which means that the result of the out-of-bounds read is never used for anything. Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Jeff King <peff@peff.net> Reviewed-by: Nicolas Pitre <nico@fluxnic.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jann Horn committed
Aug 30, 2018 at 03:09 UTC
21870efc4aab4732ba2c422ef116597c54e4a8ec
2 files changed
+2
-2
patch-delta.c
+1
-1
@@ -56,7 +56,7 @@ void *patch_delta(const void *src_buf, unsigned long src_size,
56
out += cp_size;
57
size -= cp_size;
58
} else if (cmd) {
59
- if (cmd > size)
59
+ if (cmd > size || cmd > top - data)
60
break;
61
memcpy(out, data, cmd);
62
out += cmd;
t/t5303-pack-corruption-resilience.sh
+1
-1
@@ -341,7 +341,7 @@ test_expect_success \
341
# \0 - empty base
342
# \2 - two bytes in result
343
# \2 - two literal bytes (we are short one)
344
-test_expect_failure \
344
+test_expect_success \
345
'apply delta with too few literal bytes' \
346
'printf "\0\2\2X" > truncated_delta &&
347
test_must_fail test-tool delta -p /dev/null truncated_delta /dev/null'