commit: reject overlong UTF-8 sequences
The commit code accepts pseudo-UTF-8 sequences that encode a character with more bytes than necessary. Reject such sequences, since they are not valid UTF-8. Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
brian m. carlson committed
Jul 4, 2013 at 17:20 UTC
e82bd6cc70db28dab8d0434e4033013adcd0abfa
2 files changed
+22
-6
commit.c
+12
-6
@@ -1240,11 +1240,15 @@ int commit_tree(const struct strbuf *msg, unsigned char *tree,
1240
static int find_invalid_utf8(const char *buf, int len)
1241
{
1242
int offset = 0;
1243
+ static const unsigned int max_codepoint[] = {
1244
+ 0x7f, 0x7ff, 0xffff, 0x10ffff
1245
+ };
1246
1247
while (len) {
1248
unsigned char c = *buf++;
1249
int bytes, bad_offset;
1250
unsigned int codepoint;
1251
+ unsigned int min_val, max_val;
1252
1253
len--;
1254
offset++;
@@ -1276,8 +1280,13 @@ static int find_invalid_utf8(const char *buf, int len)
1280
if (len < bytes)
1281
return bad_offset;
1282
1279
- /* Place the encoded bits at the bottom of the value. */
1283
+ /*
1284
+ * Place the encoded bits at the bottom of the value and compute the
1285
+ * valid range.
1286
+ */
1287
codepoint = (c & 0x7f) >> bytes;
1288
+ min_val = max_codepoint[bytes-1] + 1;
1289
+ max_val = max_codepoint[bytes];
1290
1291
offset += bytes;
1292
len -= bytes;
@@ -1290,8 +1299,8 @@ static int find_invalid_utf8(const char *buf, int len)
1299
return bad_offset;
1300
} while (--bytes);
1301
1293
- /* No codepoints can ever be allocated beyond U+10FFFF. */
1294
- if (codepoint > 0x10ffff)
1302
+ /* Reject codepoints that are out of range for the sequence length. */
1303
+ if (codepoint < min_val || codepoint > max_val)
1304
return bad_offset;
1305
/* Surrogates are only for UTF-16 and cannot be encoded in UTF-8. */
1306
if ((codepoint & 0x1ff800) == 0xd800)
@@ -1308,9 +1317,6 @@ static int find_invalid_utf8(const char *buf, int len)
1317
*
1318
* If it isn't, it assumes any non-utf8 characters are Latin1,
1319
* and does the conversion.
1311
- *
1312
- * Fixme: we should probably also disallow overlong forms.
1313
- * But we don't do that currently.
1320
*/
1321
static int verify_utf8(struct strbuf *buf)
1322
{
t/t3900-i18n-commit.sh
+10
@@ -48,6 +48,16 @@ test_expect_success 'UTF-8 invalid characters refused' '
48
grep "did not conform" "$HOME"/stderr
49
'
50
51
+test_expect_success 'UTF-8 overlong sequences rejected' '
52
+ test_when_finished "rm -f $HOME/stderr $HOME/invalid" &&
53
+ rm -f "$HOME/stderr" "$HOME/invalid" &&
54
+ echo "UTF-8 overlong" >F &&
55
+ printf "\340\202\251ommit message\n\nThis is not a space:\300\240\n" \
56
+ >"$HOME/invalid" &&
57
+ git commit -a -F "$HOME/invalid" 2>"$HOME"/stderr &&
58
+ grep "did not conform" "$HOME"/stderr
59
+'
60
+
61
for H in ISO8859-1 eucJP ISO-2022-JP
62
do
63
test_expect_success "$H setup" '