Fix invalid read in quote_c_style_counted
This function did not work on strings that were not NUL-terminated. It reads through a length-bounded string, searching for characters in need of quoting. After we find one, we output the quoted character, then advance our pointer to find the next one. However, we never decremented the length, meaning we ended up looking at whatever random junk was stored after the string. This bug was not found by the existing tests because most code paths feed a NUL-terminated string. The notable exception is a directory name being fed by ls-tree. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Feb 1, 2010 at 08:39 UTC
8424981934c415bd20643de9cc932bd348dfb115
2 files changed
+21
-2
quote.c
+3
-1
@@ -213,7 +213,7 @@ static size_t quote_c_style_counted(const char *name, ssize_t maxlen,
213
int ch;
214
215
len = next_quote_pos(p, maxlen);
216
- if (len == maxlen || !p[len])
216
+ if (len == maxlen || (maxlen < 0 && !p[len]))
217
break;
218
219
if (!no_dq && p == name)
@@ -223,6 +223,8 @@ static size_t quote_c_style_counted(const char *name, ssize_t maxlen,
223
EMIT('\\');
224
p += len;
225
ch = (unsigned char)*p++;
226
+ if (maxlen >= 0)
227
+ maxlen -= len + 1;
228
if (sq_lookup[ch] >= ' ') {
229
EMIT(sq_lookup[ch]);
230
} else {
t/t3902-quoted.sh
+18
-1
@@ -25,7 +25,7 @@ for_each_name () {
25
for name in \
26
Name "Name and a${LF}LF" "Name and an${HT}HT" "Name${DQ}" \
27
"$FN$HT$GN" "$FN$LF$GN" "$FN $GN" "$FN$GN" "$FN$DQ$GN" \
28
- "With SP in it"
28
+ "With SP in it" "caractère spécial/file"
29
do
30
eval "$1"
31
done
@@ -33,6 +33,7 @@ for_each_name () {
33
34
test_expect_success setup '
35
36
+ mkdir "caractère spécial" &&
37
for_each_name "echo initial >\"\$name\""
38
git add . &&
39
git commit -q -m Initial &&
@@ -50,6 +51,7 @@ Name
51
"Name and an\tHT"
52
"Name\""
53
With SP in it
54
+"caract\303\250re sp\303\251cial/file"
55
"\346\277\261\351\207\216\t\347\264\224"
56
"\346\277\261\351\207\216\n\347\264\224"
57
"\346\277\261\351\207\216 \347\264\224"
@@ -63,6 +65,7 @@ Name
65
"Name and an\tHT"
66
"Name\""
67
With SP in it
68
+caractère spécial/file
69
"濱野\t純"
70
"濱野\n純"
71
濱野 純
@@ -97,6 +100,13 @@ test_expect_success 'check fully quoted output from diff-tree' '
100
101
'
102
103
+test_expect_success 'check fully quoted output from ls-tree' '
104
+
105
+ git ls-tree --name-only -r HEAD >current &&
106
+ test_cmp expect.quoted current
107
+
108
+'
109
+
110
test_expect_success 'setting core.quotepath' '
111
112
git config --bool core.quotepath false
@@ -130,4 +140,11 @@ test_expect_success 'check fully quoted output from diff-tree' '
140
141
'
142
143
+test_expect_success 'check fully quoted output from ls-tree' '
144
+
145
+ git ls-tree --name-only -r HEAD >current &&
146
+ test_cmp expect.raw current
147
+
148
+'
149
+
150
test_done