Revision 24557209500e6ed618f04a8795a111a0c491a29c authored by Patrick Steinhardt on 01 December 2022, 14:45:23 UTC, committed by Junio C Hamano on 05 December 2022, 06:14:16 UTC
It is possible to trigger an integer overflow when parsing attribute names that are longer than 2^31 bytes because we assign the result of strlen(3P) to an `int` instead of to a `size_t`. This can lead to an abort in vsnprintf(3P) with the following reproducer: blob=$(perl -e 'print "A " . "B"x2147483648 . "\n"' | git hash-object -w --stdin) git update-index --add --cacheinfo 100644,$blob,.gitattributes git check-attr --all path BUG: strbuf.c:400: your vsnprintf is broken (returned -1) But furthermore, assuming that the attribute name is even longer than that, it can cause us to silently truncate the attribute and thus lead to wrong results. Fix this integer overflow by using a `size_t` instead. This fixes the silent truncation of attribute names, but it only partially fixes the BUG we hit: even though the initial BUG is fixed, we can still hit a BUG when parsing invalid attribute lines via `report_invalid_attr()`. This is due to an underlying design issue in vsnprintf(3P) which only knows to return an `int`, and thus it may always overflow with large inputs. This issue is benign though: the worst that can happen is that the error message is misreported to be either truncated or too long, but due to the buffer being NUL terminated we wouldn't ever do an out-of-bounds read here. Reported-by: Markus Vervier <markus.vervier@x41-dsec.de> Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
1 parent 8d0d48c
.gitignore
/fuzz-commit-graph
/fuzz_corpora
/fuzz-pack-headers
/fuzz-pack-idx
/GIT-BUILD-OPTIONS
/GIT-CFLAGS
/GIT-LDFLAGS
/GIT-PREFIX
/GIT-PERL-DEFINES
/GIT-PERL-HEADER
/GIT-PYTHON-VARS
/GIT-SCRIPT-DEFINES
/GIT-USER-AGENT
/GIT-VERSION-FILE
/bin-wrappers/
/git
/git-add
/git-add--interactive
/git-am
/git-annotate
/git-apply
/git-archimport
/git-archive
/git-bisect
/git-bisect--helper
/git-blame
/git-branch
/git-bugreport
/git-bundle
/git-cat-file
/git-check-attr
/git-check-ignore
/git-check-mailmap
/git-check-ref-format
/git-checkout
/git-checkout-index
/git-cherry
/git-cherry-pick
/git-clean
/git-clone
/git-column
/git-commit
/git-commit-graph
/git-commit-tree
/git-config
/git-count-objects
/git-credential
/git-credential-cache
/git-credential-cache--daemon
/git-credential-store
/git-cvsexportcommit
/git-cvsimport
/git-cvsserver
/git-daemon
/git-diff
/git-diff-files
/git-diff-index
/git-diff-tree
/git-difftool
/git-difftool--helper
/git-describe
/git-env--helper
/git-fast-export
/git-fast-import
/git-fetch
/git-fetch-pack
/git-filter-branch
/git-fmt-merge-msg
/git-for-each-ref
/git-for-each-repo
/git-format-patch
/git-fsck
/git-fsck-objects
/git-gc
/git-get-tar-commit-id
/git-grep
/git-hash-object
/git-help
/git-http-backend
/git-http-fetch
/git-http-push
/git-imap-send
/git-index-pack
/git-init
/git-init-db
/git-interpret-trailers
/git-instaweb
/git-log
/git-ls-files
/git-ls-remote
/git-ls-tree
/git-mailinfo
/git-mailsplit
/git-maintenance
/git-merge
/git-merge-base
/git-merge-index
/git-merge-file
/git-merge-tree
/git-merge-octopus
/git-merge-one-file
/git-merge-ours
/git-merge-recursive
/git-merge-resolve
/git-merge-subtree
/git-mergetool
/git-mergetool--lib
/git-mktag
/git-mktree
/git-multi-pack-index
/git-mv
/git-name-rev
/git-notes
/git-p4
/git-pack-redundant
/git-pack-objects
/git-pack-refs
/git-patch-id
/git-prune
/git-prune-packed
/git-pull
/git-push
/git-quiltimport
/git-range-diff
/git-read-tree
/git-rebase
/git-rebase--preserve-merges
/git-receive-pack
/git-reflog
/git-remote
/git-remote-http
/git-remote-https
/git-remote-ftp
/git-remote-ftps
/git-remote-fd
/git-remote-ext
/git-repack
/git-replace
/git-request-pull
/git-rerere
/git-reset
/git-restore
/git-rev-list
/git-rev-parse
/git-revert
/git-rm
/git-send-email
/git-send-pack
/git-sh-i18n
/git-sh-i18n--envsubst
/git-sh-setup
/git-shell
/git-shortlog
/git-show
/git-show-branch
/git-show-index
/git-show-ref
/git-sparse-checkout
/git-stage
/git-stash
/git-status
/git-stripspace
/git-submodule
/git-submodule--helper
/git-svn
/git-switch
/git-symbolic-ref
/git-tag
/git-unpack-file
/git-unpack-objects
/git-update-index
/git-update-ref
/git-update-server-info
/git-upload-archive
/git-upload-pack
/git-var
/git-verify-commit
/git-verify-pack
/git-verify-tag
/git-web--browse
/git-whatchanged
/git-worktree
/git-write-tree
/git-core-*/?*
/gitweb/GITWEB-BUILD-OPTIONS
/gitweb/gitweb.cgi
/gitweb/static/gitweb.js
/gitweb/static/gitweb.min.*
/config-list.h
/command-list.h
*.tar.gz
*.dsc
*.deb
/git.spec
*.exe
*.[aos]
*.o.json
*.py[co]
.depend/
*.gcda
*.gcno
*.gcov
/coverage-untested-functions
/cover_db/
/cover_db_html/
*+
/config.mak
/autom4te.cache
/config.cache
/config.log
/config.status
/config.mak.autogen
/config.mak.append
/configure
/.vscode/
/tags
/TAGS
/cscope*
/compile_commands.json
*.hcc
*.obj
*.lib
*.res
*.sln
*.suo
*.ncb
*.vcproj
*.user
*.idb
*.pdb
*.ilk
*.iobj
*.ipdb
*.dll
.vs/
Debug/
Release/
/UpgradeLog*.htm
/git.VC.VC.opendb
/git.VC.db
*.dSYM
/contrib/buildsystems/out
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...