author | Thomas Jarosch <thomas.jarosch@intra2net.com> | |
Fri, 17 Apr 2009 12:05:11 +0000 (14:05 +0200) | ||
committer | Junio C Hamano <gitster@pobox.com> | |
Sat, 18 Apr 2009 03:59:01 +0000 (20:59 -0700) | ||
commit | e0b3cc0dffbc965ffa33155cbdcf8d44716c134c | |
tree | b6576c5a1c8415e977c9fb4d1eac2d7a8a2f9dc2 | tree | snapshot |
parent | c6d8f7635f619f6576dccf17c1f1264d2cc37a2a | commit | diff |
Fix buffer overflow in config parser
When interpreting a config value, the config parser reads in 1+ space
character(s) and puts -one- space character in the buffer as soon as
the first non-space character is encountered (if not inside quotes).
Unfortunately the buffer size check lacks the extra space character
which gets inserted at the next non-space character, resulting in
a crash with a specially crafted config entry.
The unit test now uses Java to compile a platform independent
.NET framework to output the test string in C# :o)
Read: Thanks to Johannes Sixt for the correct printf call
which replaces the perl invocation.
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
When interpreting a config value, the config parser reads in 1+ space
character(s) and puts -one- space character in the buffer as soon as
the first non-space character is encountered (if not inside quotes).
Unfortunately the buffer size check lacks the extra space character
which gets inserted at the next non-space character, resulting in
a crash with a specially crafted config entry.
The unit test now uses Java to compile a platform independent
.NET framework to output the test string in C# :o)
Read: Thanks to Johannes Sixt for the correct printf call
which replaces the perl invocation.
Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
config.c | diff | blob | history | |
t/t1303-wacky-config.sh | diff | blob | history |