blame: don't overflow time buffer
When showing the raw timestamp, we format the numeric seconds-since-epoch into a buffer, followed by the timezone string. This string has come straight from the commit object. A well-formed object should have a timezone string of only a few bytes, but we could be operating on data pushed by a malicious user. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Dec 8, 2011 at 05:25 UTC
c3ea051544cb1d98a5ae7f64d077084a9a5db5c1
1 file changed
+1
-1
builtin/blame.c
+1
-1
@@ -1598,7 +1598,7 @@ static const char *format_time(unsigned long time, const char *tz_str,
1598
int tz;
1599
1600
if (show_raw_time) {
1601
- sprintf(time_buf, "%lu %s", time, tz_str);
1601
+ snprintf(time_buf, sizeof(time_buf), "%lu %s", time, tz_str);
1602
}
1603
else {
1604
tz = atoi(tz_str);