show-branch: store resolved head in heap buffer

We resolve HEAD and copy the result to a fixed-size buffer with memcpy, never checking that it actually fits. This bug dates back to 8098a178b (Add git-symbolic-ref, 2005-09-30). Before that we used readlink(), which took a maximum buffer size. We can fix this by using resolve_refdup(), which duplicates the buffer on the heap. That also lets us just check for a NULL pointer to see if we have resolved HEAD, and drop the extra head_p variable. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Feb 14, 2017 at 12:27 UTC d9e557a320bd4695bccad873e176562489b2d199
1 file changed +5 -14
builtin/show-branch.c
+5 -14
@@ -473,8 +473,7 @@ static void snarf_refs(int head, int remotes)
473 static int rev_is_head(char *head, char *name,
474 unsigned char *head_sha1, unsigned char *sha1)
475 {
476 - if ((!head[0]) ||
477 - (head_sha1 && sha1 && hashcmp(head_sha1, sha1)))
476 + if (!head || (head_sha1 && sha1 && hashcmp(head_sha1, sha1)))
477 return 0;
478 if (starts_with(head, "refs/heads/"))
479 head += 11;
@@ -621,8 +620,7 @@ int cmd_show_branch(int ac, const char **av, const char *prefix)
620 int all_heads = 0, all_remotes = 0;
621 int all_mask, all_revs;
622 enum rev_sort_order sort_order = REV_SORT_IN_GRAPH_ORDER;
624 - char head[128];
625 - const char *head_p;
623 + char *head;
624 struct object_id head_oid;
625 int merge_base = 0;
626 int independent = 0;
@@ -786,17 +784,10 @@ int cmd_show_branch(int ac, const char **av, const char *prefix)
784 snarf_refs(all_heads, all_remotes);
785 }
786
789 - head_p = resolve_ref_unsafe("HEAD", RESOLVE_REF_READING,
790 - head_oid.hash, NULL);
791 - if (head_p) {
792 - size_t head_len = strlen(head_p);
793 - memcpy(head, head_p, head_len + 1);
794 - }
795 - else {
796 - head[0] = 0;
797 - }
787 + head = resolve_refdup("HEAD", RESOLVE_REF_READING,
788 + head_oid.hash, NULL);
789
799 - if (with_current_branch && head_p) {
790 + if (with_current_branch && head) {
791 int has_head = 0;
792 for (i = 0; !has_head && i < ref_name_cnt; i++) {
793 /* We are only interested in adding the branch