Revision 447ac906e189535e77dcb1f4bbe3f1bc917d4c12 authored by Patrick Steinhardt on 01 December 2022, 14:45:31 UTC, committed by Junio C Hamano on 05 December 2022, 06:14:16 UTC
The `struct attr_stack` tracks the stack of all patterns together with their attributes. When parsing a gitattributes file that has more than 2^31 such patterns though we may trigger multiple out-of-bounds reads on 64 bit platforms. This is because while the `num_matches` variable is an unsigned integer, we always use a signed integer to iterate over them. I have not been able to reproduce this issue due to memory constraints on my systems. But despite the out-of-bounds reads, the worst thing that can seemingly happen is to call free(3P) with a garbage pointer when calling `attr_stack_free()`. Fix this bug by using unsigned integers to iterate over the array. While this makes the iteration somewhat awkward when iterating in reverse, it is at least better than knowingly running into an out-of-bounds read. While at it, convert the call to `ALLOC_GROW` to use `ALLOC_GROW_BY` instead. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
1 parent 34ace8b
split-index.h
#ifndef SPLIT_INDEX_H
#define SPLIT_INDEX_H
#include "cache.h"
struct index_state;
struct strbuf;
struct ewah_bitmap;
struct split_index {
struct object_id base_oid;
struct index_state *base;
struct ewah_bitmap *delete_bitmap;
struct ewah_bitmap *replace_bitmap;
struct cache_entry **saved_cache;
unsigned int saved_cache_nr;
unsigned int nr_deletions;
unsigned int nr_replacements;
int refcount;
};
struct split_index *init_split_index(struct index_state *istate);
void save_or_free_index_entry(struct index_state *istate, struct cache_entry *ce);
void replace_index_entry_in_base(struct index_state *istate,
struct cache_entry *old,
struct cache_entry *new_entry);
int read_link_extension(struct index_state *istate,
const void *data, unsigned long sz);
int write_link_extension(struct strbuf *sb,
struct index_state *istate);
void move_cache_to_base_index(struct index_state *istate);
void merge_base_index(struct index_state *istate);
void prepare_to_write_split_index(struct index_state *istate);
void finish_writing_split_index(struct index_state *istate);
void discard_split_index(struct index_state *istate);
void add_split_index(struct index_state *istate);
void remove_split_index(struct index_state *istate);
#endif
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...