color: protect against out-of-bounds reads and writes
want_color_fd() is designed to work only with standard output and error file descriptors and stores information about each descriptor in an array. However, it doesn't verify that the passed-in descriptor lives within that set, which, with a buggy caller, could lead to access or assignment outside the array bounds. Signed-off-by: Eric Sunshine <sunshine@sunshineco.com> Acked-by: Johannes Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Jonathan Nieder <jrnieder@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Eric Sunshine committed
Aug 2, 2018 at 23:07 UTC
65bb21e77e7f12e215974018b4b1febcb87c85c9
1 file changed
+3
color.c
+3
@@ -343,6 +343,9 @@ int want_color_fd(int fd, int var)
343
344
static int want_auto[3] = { -1, -1, -1 };
345
346
+ if (fd < 1 || fd >= ARRAY_SIZE(want_auto))
347
+ BUG("file descriptor out of range: %d", fd);
348
+
349
if (var < 0)
350
var = git_use_color_default;
351