config.c: avoid integer truncation in `copy_or_rename_section_in_file()`

There are a couple of spots within `copy_or_rename_section_in_file()` that incorrectly use an `int` to track an offset within a string, which may truncate or wrap around to a negative value. Historically it was impossible to have a line longer than 1024 bytes anyway, since we used fgets() with a fixed-size buffer of exactly that length. But the recent change to use a strbuf permits us to read lines of arbitrary length, so it's possible for a malicious input to cause us to overflow past INT_MAX and do an out-of-bounds array read. Practically speaking, however, this should never happen, since it requires 2GB section names or values, which are unrealistic in non-malicious circumstances. Co-authored-by: Jeff King <peff@peff.net> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Taylor Blau <me@ttaylorr.com>

Taylor Blau committed Apr 6, 2023 at 14:28 UTC e91cfe6085c4a61372d1f800b473b73b8d225d0d
1 file changed +5 -5
config.c
+5 -5
@@ -3027,9 +3027,10 @@ void git_config_set_multivar(const char *key, const char *value,
3027 flags);
3028 }
3029
3030 -static int section_name_match (const char *buf, const char *name)
3030 +static size_t section_name_match (const char *buf, const char *name)
3031 {
3032 - int i = 0, j = 0, dot = 0;
3032 + size_t i = 0, j = 0;
3033 + int dot = 0;
3034 if (buf[i] != '[')
3035 return 0;
3036 for (i = 1; buf[i] && buf[i] != ']'; i++) {
@@ -3133,15 +3134,14 @@ static int git_config_copy_or_rename_section_in_file(const char *config_filename
3134 }
3135
3136 while (!strbuf_getwholeline(&buf, config_file, '\n')) {
3136 - unsigned i;
3137 - int length;
3137 + size_t i, length;
3138 int is_section = 0;
3139 char *output = buf.buf;
3140 for (i = 0; buf.buf[i] && isspace(buf.buf[i]); i++)
3141 ; /* do nothing */
3142 if (buf.buf[i] == '[') {
3143 /* it's a section */
3144 - int offset;
3144 + size_t offset;
3145 is_section = 1;
3146
3147 /*