From 64cc1c0909949fa2866ad71ad2d1ab7ccaa673d9 Mon Sep 17 00:00:00 2001 From: Martin Koegler Date: Sun, 6 Jan 2008 18:21:10 +0100 Subject: [PATCH] tree-walk: don't parse incorrect entries The current code can access memory outside of the tree buffer in the case of malformed tree entries. This patch prevents this by: * The rest of the buffer must be at least 24 bytes (at least 1 byte mode, 1 blank, at least one byte path name, 1 NUL, 20 bytes sha1). * Check that the last NUL (21 bytes before the end) is present. This ensures that strlen() and get_mode() calls stay within the buffer. * The mode may not be empty. We have only to reject a blank at the begin, as the rest is handled by if (c < '0' || c > '7'). * The blank is ensured by get_mode(). * The path must contain at least one character. Signed-off-by: Martin Koegler Signed-off-by: Junio C Hamano --- tree-walk.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tree-walk.c b/tree-walk.c index 8d4b67317..142205ddc 100644 --- a/tree-walk.c +++ b/tree-walk.c @@ -7,6 +7,9 @@ static const char *get_mode(const char *str, unsigned int *modep) unsigned char c; unsigned int mode = 0; + if (*str == ' ') + return NULL; + while ((c = *str++) != ' ') { if (c < '0' || c > '7') return NULL; @@ -16,13 +19,16 @@ static const char *get_mode(const char *str, unsigned int *modep) return str; } -static void decode_tree_entry(struct tree_desc *desc, const void *buf, unsigned long size) +static void decode_tree_entry(struct tree_desc *desc, const char *buf, unsigned long size) { const char *path; unsigned int mode, len; + if (size < 24 || buf[size - 21]) + die("corrupt tree file"); + path = get_mode(buf, &mode); - if (!path) + if (!path || !*path) die("corrupt tree file"); len = strlen(path) + 1; -- 2.30.2