Fix buffer overflow in git diff
If PATH_MAX on your system is smaller than a path stored, it may cause buffer overflow and stack corruption in diff_addremove() and diff_change() functions when running git-diff Signed-off-by: Dmitry Potapov <dpotapov@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Dmitry Potapov committed
Jul 16, 2008 at 18:54 UTC
fd55a19eb1d49ae54008d932a65f79cd6fda45c9
5 files changed
+34
-25
diff-lib.c
+4
-4
@@ -171,7 +171,7 @@ int run_diff_files(struct rev_info *revs, unsigned int option)
171
if (silent_on_removed)
172
continue;
173
diff_addremove(&revs->diffopt, '-', ce->ce_mode,
174
- ce->sha1, ce->name, NULL);
174
+ ce->sha1, ce->name);
175
continue;
176
}
177
changed = ce_match_stat(ce, &st, ce_option);
@@ -184,7 +184,7 @@ int run_diff_files(struct rev_info *revs, unsigned int option)
184
newmode = ce_mode_from_stat(ce, st.st_mode);
185
diff_change(&revs->diffopt, oldmode, newmode,
186
ce->sha1, (changed ? null_sha1 : ce->sha1),
187
- ce->name, NULL);
187
+ ce->name);
188
189
}
190
diffcore_std(&revs->diffopt);
@@ -208,7 +208,7 @@ static void diff_index_show_file(struct rev_info *revs,
208
const unsigned char *sha1, unsigned int mode)
209
{
210
diff_addremove(&revs->diffopt, prefix[0], mode,
211
- sha1, ce->name, NULL);
211
+ sha1, ce->name);
212
}
213
214
static int get_stat_data(struct cache_entry *ce,
@@ -312,7 +312,7 @@ static int show_modified(struct oneway_unpack_data *cbdata,
312
return 0;
313
314
diff_change(&revs->diffopt, oldmode, mode,
315
- old->sha1, sha1, old->name, NULL);
315
+ old->sha1, sha1, old->name);
316
return 0;
317
}
318
diff.c
+2
-9
@@ -3356,9 +3356,8 @@ int diff_result_code(struct diff_options *opt, int status)
3356
void diff_addremove(struct diff_options *options,
3357
int addremove, unsigned mode,
3358
const unsigned char *sha1,
3359
- const char *base, const char *path)
3359
+ const char *concatpath)
3360
{
3361
- char concatpath[PATH_MAX];
3361
struct diff_filespec *one, *two;
3362
3363
if (DIFF_OPT_TST(options, IGNORE_SUBMODULES) && S_ISGITLINK(mode))
@@ -3380,9 +3379,6 @@ void diff_addremove(struct diff_options *options,
3379
addremove = (addremove == '+' ? '-' :
3380
addremove == '-' ? '+' : addremove);
3381
3383
- if (!path) path = "";
3384
- sprintf(concatpath, "%s%s", base, path);
3385
-
3382
if (options->prefix &&
3383
strncmp(concatpath, options->prefix, options->prefix_length))
3384
return;
@@ -3403,9 +3399,8 @@ void diff_change(struct diff_options *options,
3399
unsigned old_mode, unsigned new_mode,
3400
const unsigned char *old_sha1,
3401
const unsigned char *new_sha1,
3406
- const char *base, const char *path)
3402
+ const char *concatpath)
3403
{
3408
- char concatpath[PATH_MAX];
3404
struct diff_filespec *one, *two;
3405
3406
if (DIFF_OPT_TST(options, IGNORE_SUBMODULES) && S_ISGITLINK(old_mode)
@@ -3418,8 +3413,6 @@ void diff_change(struct diff_options *options,
3413
tmp = old_mode; old_mode = new_mode; new_mode = tmp;
3414
tmp_c = old_sha1; old_sha1 = new_sha1; new_sha1 = tmp_c;
3415
}
3421
- if (!path) path = "";
3422
- sprintf(concatpath, "%s%s", base, path);
3416
3417
if (options->prefix &&
3418
strncmp(concatpath, options->prefix, options->prefix_length))
diff.h
+4
-5
@@ -14,12 +14,12 @@ typedef void (*change_fn_t)(struct diff_options *options,
14
unsigned old_mode, unsigned new_mode,
15
const unsigned char *old_sha1,
16
const unsigned char *new_sha1,
17
- const char *base, const char *path);
17
+ const char *fullpath);
18
19
typedef void (*add_remove_fn_t)(struct diff_options *options,
20
int addremove, unsigned mode,
21
const unsigned char *sha1,
22
- const char *base, const char *path);
22
+ const char *fullpath);
23
24
typedef void (*diff_format_fn_t)(struct diff_queue_struct *q,
25
struct diff_options *options, void *data);
@@ -164,14 +164,13 @@ extern void diff_addremove(struct diff_options *,
164
int addremove,
165
unsigned mode,
166
const unsigned char *sha1,
167
- const char *base,
168
- const char *path);
167
+ const char *fullpath);
168
169
extern void diff_change(struct diff_options *,
170
unsigned mode1, unsigned mode2,
171
const unsigned char *sha1,
172
const unsigned char *sha2,
174
- const char *base, const char *path);
173
+ const char *fullpath);
174
175
extern void diff_unmerge(struct diff_options *,
176
const char *path,
revision.c
+2
-2
@@ -259,7 +259,7 @@ static int tree_difference = REV_TREE_SAME;
259
static void file_add_remove(struct diff_options *options,
260
int addremove, unsigned mode,
261
const unsigned char *sha1,
262
- const char *base, const char *path)
262
+ const char *fullpath)
263
{
264
int diff = REV_TREE_DIFFERENT;
265
@@ -285,7 +285,7 @@ static void file_change(struct diff_options *options,
285
unsigned old_mode, unsigned new_mode,
286
const unsigned char *old_sha1,
287
const unsigned char *new_sha1,
288
- const char *base, const char *path)
288
+ const char *fullpath)
289
{
290
tree_difference = REV_TREE_DIFFERENT;
291
DIFF_OPT_SET(options, HAS_CHANGES);
tree-diff.c
+22
-5
@@ -15,6 +15,15 @@ static char *malloc_base(const char *base, int baselen, const char *path, int pa
15
return newbase;
16
}
17
18
+static char *malloc_fullname(const char *base, int baselen, const char *path, int pathlen)
19
+{
20
+ char *fullname = xmalloc(baselen + pathlen + 1);
21
+ memcpy(fullname, base, baselen);
22
+ memcpy(fullname + baselen, path, pathlen);
23
+ fullname[baselen + pathlen] = 0;
24
+ return fullname;
25
+}
26
+
27
static void show_entry(struct diff_options *opt, const char *prefix, struct tree_desc *desc,
28
const char *base, int baselen);
29
@@ -24,6 +33,7 @@ static int compare_tree_entry(struct tree_desc *t1, struct tree_desc *t2, const
33
const char *path1, *path2;
34
const unsigned char *sha1, *sha2;
35
int cmp, pathlen1, pathlen2;
36
+ char *fullname;
37
38
sha1 = tree_entry_extract(t1, &path1, &mode1);
39
sha2 = tree_entry_extract(t2, &path2, &mode2);
@@ -55,15 +65,20 @@ static int compare_tree_entry(struct tree_desc *t1, struct tree_desc *t2, const
65
if (DIFF_OPT_TST(opt, RECURSIVE) && S_ISDIR(mode1)) {
66
int retval;
67
char *newbase = malloc_base(base, baselen, path1, pathlen1);
58
- if (DIFF_OPT_TST(opt, TREE_IN_RECURSIVE))
68
+ if (DIFF_OPT_TST(opt, TREE_IN_RECURSIVE)) {
69
+ newbase[baselen + pathlen1] = 0;
70
opt->change(opt, mode1, mode2,
60
- sha1, sha2, base, path1);
71
+ sha1, sha2, newbase);
72
+ newbase[baselen + pathlen1] = '/';
73
+ }
74
retval = diff_tree_sha1(sha1, sha2, newbase, opt);
75
free(newbase);
76
return retval;
77
}
78
66
- opt->change(opt, mode1, mode2, sha1, sha2, base, path1);
79
+ fullname = malloc_fullname(base, baselen, path1, pathlen1);
80
+ opt->change(opt, mode1, mode2, sha1, sha2, fullname);
81
+ free(fullname);
82
return 0;
83
}
84
@@ -205,10 +220,10 @@ static void show_entry(struct diff_options *opt, const char *prefix, struct tree
220
unsigned mode;
221
const char *path;
222
const unsigned char *sha1 = tree_entry_extract(desc, &path, &mode);
223
+ int pathlen = tree_entry_len(path, sha1);
224
225
if (DIFF_OPT_TST(opt, RECURSIVE) && S_ISDIR(mode)) {
226
enum object_type type;
211
- int pathlen = tree_entry_len(path, sha1);
227
char *newbase = malloc_base(base, baselen, path, pathlen);
228
struct tree_desc inner;
229
void *tree;
@@ -224,7 +239,9 @@ static void show_entry(struct diff_options *opt, const char *prefix, struct tree
239
free(tree);
240
free(newbase);
241
} else {
227
- opt->add_remove(opt, prefix[0], mode, sha1, base, path);
242
+ char *fullname = malloc_fullname(base, baselen, path, pathlen);
243
+ opt->add_remove(opt, prefix[0], mode, sha1, fullname);
244
+ free(fullname);
245
}
246
}
247