Fix buffer overflow in prepare_attr_stack

If PATH_MAX on your system is smaller than a path stored in the git repo, it may cause the buffer overflow in prepare_attr_stack. Signed-off-by: Dmitry Potapov <dpotapov@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Dmitry Potapov committed Jul 16, 2008 at 19:39 UTC f66cf96d7c613a8129436a5d76ef7b74ee302436

1 file changed +9 -6

attr.c

+9 -6

@@ -459,7 +459,9 @@ static void prepare_attr_stack(const char *path, int dirlen)

459 {

460 struct attr_stack *elem, *info;

461 int len;

462 - char pathbuf[PATH_MAX];

462 + struct strbuf pathbuf;

463 +

464 + strbuf_init(&pathbuf, dirlen+2+strlen(GITATTRIBUTES_FILE));

465

466 /*

467 * At the bottom of the attribute stack is the built-in

@@ -510,13 +512,14 @@ static void prepare_attr_stack(const char *path, int dirlen)

512 len = strlen(attr_stack->origin);

513 if (dirlen <= len)

514 break;

513 - memcpy(pathbuf, path, dirlen);

514 - memcpy(pathbuf + dirlen, "/", 2);

515 - cp = strchr(pathbuf + len + 1, '/');

515 + strbuf_reset(&pathbuf);

516 + strbuf_add(&pathbuf, path, dirlen);

517 + strbuf_addch(&pathbuf, '/');

518 + cp = strchr(pathbuf.buf + len + 1, '/');

519 strcpy(cp + 1, GITATTRIBUTES_FILE);

517 - elem = read_attr(pathbuf, 0);

520 + elem = read_attr(pathbuf.buf, 0);

521 *cp = '\0';

519 - elem->origin = strdup(pathbuf);

522 + elem->origin = strdup(pathbuf.buf);

523 elem->prev = attr_stack;

524 attr_stack = elem;

525 debug_push(elem);