Revision 447ac906e189535e77dcb1f4bbe3f1bc917d4c12 authored by Patrick Steinhardt on 01 December 2022, 14:45:31 UTC, committed by Junio C Hamano on 05 December 2022, 06:14:16 UTC
The `struct attr_stack` tracks the stack of all patterns together with their attributes. When parsing a gitattributes file that has more than 2^31 such patterns though we may trigger multiple out-of-bounds reads on 64 bit platforms. This is because while the `num_matches` variable is an unsigned integer, we always use a signed integer to iterate over them. I have not been able to reproduce this issue due to memory constraints on my systems. But despite the out-of-bounds reads, the worst thing that can seemingly happen is to call free(3P) with a garbage pointer when calling `attr_stack_free()`. Fix this bug by using unsigned integers to iterate over the array. While this makes the iteration somewhat awkward when iterating in reverse, it is at least better than knowingly running into an out-of-bounds read. While at it, convert the call to `ALLOC_GROW` to use `ALLOC_GROW_BY` instead. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
1 parent 34ace8b
sigchain.h
#ifndef SIGCHAIN_H
#define SIGCHAIN_H
/**
* Code often wants to set a signal handler to clean up temporary files or
* other work-in-progress when we die unexpectedly. For multiple pieces of
* code to do this without conflicting, each piece of code must remember
* the old value of the handler and restore it either when:
*
* 1. The work-in-progress is finished, and the handler is no longer
* necessary. The handler should revert to the original behavior
* (either another handler, SIG_DFL, or SIG_IGN).
*
* 2. The signal is received. We should then do our cleanup, then chain
* to the next handler (or die if it is SIG_DFL).
*
* Sigchain is a tiny library for keeping a stack of handlers. Your handler
* and installation code should look something like:
*
* ------------------------------------------
* void clean_foo_on_signal(int sig)
* {
* clean_foo();
* sigchain_pop(sig);
* raise(sig);
* }
*
* void other_func()
* {
* sigchain_push_common(clean_foo_on_signal);
* mess_up_foo();
* clean_foo();
* }
* ------------------------------------------
*
*/
/**
* Handlers are given the typedef of sigchain_fun. This is the same type
* that is given to signal() or sigaction(). It is perfectly reasonable to
* push SIG_DFL or SIG_IGN onto the stack.
*/
typedef void (*sigchain_fun)(int);
/* You can sigchain_push and sigchain_pop individual signals. */
int sigchain_push(int sig, sigchain_fun f);
int sigchain_pop(int sig);
/**
* push the handler onto the stack for the common signals:
* SIGINT, SIGHUP, SIGTERM, SIGQUIT and SIGPIPE.
*/
void sigchain_push_common(sigchain_fun f);
void sigchain_pop_common(void);
#endif /* SIGCHAIN_H */
Computing file changes ...
