@matheusbsbs / matheus-bagliano / commits / 48050c42c7

pretty: fix integer overflow in wrapping format

The `%w(width,indent1,indent2)` formatting directive can be used to rewrap text to a specific width and is designed after git-shortlog(1)'s `-w` parameter. While the three parameters are all stored as `size_t` internally, `strbuf_add_wrapped_text()` accepts integers as input. As a result, the casted integers may overflow. As these now-negative integers are later on passed to `strbuf_addchars()`, we will ultimately run into implementation-defined behaviour due to casting a negative number back to `size_t` again. On my platform, this results in trying to allocate 9000 petabyte of memory. Fix this overflow by using `cast_size_t_to_int()` so that we reject inputs that cannot be represented as an integer. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Patrick Steinhardt committed Dec 1, 2022 at 15:46 UTC 48050c42c73c28b0c001d63d11dffac7e116847b

3 files changed +23 -1

git-compat-util.h

@@ -918,6 +918,14 @@ static inline size_t st_sub(size_t a, size_t b)

918 return a - b;

919 }

920

921 +static inline int cast_size_t_to_int(size_t a)

922 +{

923 + if (a > INT_MAX)

924 + die("number too large to represent as int on this platform: %"PRIuMAX,

925 + (uintmax_t)a);

926 + return (int)a;

927 +}

928 +

929 #ifdef HAVE_ALLOCA_H

930 # include <alloca.h>

931 # define xalloca(size) (alloca(size))

pretty.c

+3 -1

@@ -915,7 +915,9 @@ static void strbuf_wrap(struct strbuf *sb, size_t pos,

915 if (pos)

916 strbuf_add(&tmp, sb->buf, pos);

917 strbuf_add_wrapped_text(&tmp, sb->buf + pos,

918 - (int) indent1, (int) indent2, (int) width);

918 + cast_size_t_to_int(indent1),

919 + cast_size_t_to_int(indent2),

920 + cast_size_t_to_int(width));

921 strbuf_swap(&tmp, sb);

922 strbuf_release(&tmp);

923 }

t/t4205-log-pretty-formats.sh

+12

@@ -887,6 +887,18 @@ test_expect_success 'log --pretty with magical wrapping directives' '

887 test_cmp expect actual

888 '

889

890 +test_expect_success SIZE_T_IS_64BIT 'log --pretty with overflowing wrapping directive' '

891 + cat >expect <<-EOF &&

892 + fatal: number too large to represent as int on this platform: 2147483649

893 + EOF

894 + test_must_fail git log -1 --pretty="format:%w(2147483649,1,1)%d" 2>error &&

895 + test_cmp expect error &&

896 + test_must_fail git log -1 --pretty="format:%w(1,2147483649,1)%d" 2>error &&

897 + test_cmp expect error &&

898 + test_must_fail git log -1 --pretty="format:%w(1,1,2147483649)%d" 2>error &&

899 + test_cmp expect error

900 +'

901 +

902 test_expect_success EXPENSIVE,SIZE_T_IS_64BIT 'log --pretty with huge commit message' '

903 # We only assert that this command does not crash. This needs to be

904 # executed with the address sanitizer to demonstrate failure.