tree-walk: don't parse incorrect entries
The current code can access memory outside of the tree buffer in the case of malformed tree entries. This patch prevents this by: * The rest of the buffer must be at least 24 bytes (at least 1 byte mode, 1 blank, at least one byte path name, 1 NUL, 20 bytes sha1). * Check that the last NUL (21 bytes before the end) is present. This ensures that strlen() and get_mode() calls stay within the buffer. * The mode may not be empty. We have only to reject a blank at the begin, as the rest is handled by if (c < '0' || c > '7'). * The blank is ensured by get_mode(). * The path must contain at least one character. Signed-off-by: Martin Koegler <mkoegler@auto.tuwien.ac.at> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Martin Koegler committed
Jan 6, 2008 at 18:21 UTC
64cc1c0909949fa2866ad71ad2d1ab7ccaa673d9
1 file changed
+8
-2
tree-walk.c
+8
-2
@@ -7,6 +7,9 @@ static const char *get_mode(const char *str, unsigned int *modep)
7
unsigned char c;
8
unsigned int mode = 0;
9
10
+ if (*str == ' ')
11
+ return NULL;
12
+
13
while ((c = *str++) != ' ') {
14
if (c < '0' || c > '7')
15
return NULL;
@@ -16,13 +19,16 @@ static const char *get_mode(const char *str, unsigned int *modep)
19
return str;
20
}
21
19
-static void decode_tree_entry(struct tree_desc *desc, const void *buf, unsigned long size)
22
+static void decode_tree_entry(struct tree_desc *desc, const char *buf, unsigned long size)
23
{
24
const char *path;
25
unsigned int mode, len;
26
27
+ if (size < 24 || buf[size - 21])
28
+ die("corrupt tree file");
29
+
30
path = get_mode(buf, &mode);
25
- if (!path)
31
+ if (!path || !*path)
32
die("corrupt tree file");
33
len = strlen(path) + 1;
34