averello/git-mirror
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2025-12-12 20:36:24 +01:00
Code Issues Packages Projects Releases Wiki Activity

builtin/blame: fix out-of-bounds read with excessive --abbrev

Browse Source 
In 6411a0a896 (builtin/blame: fix type of `length` variable when
emitting object ID, 2024-12-06) we have fixed the type of the `length`
variable. In order to avoid a cast from `size_t` to `int` in the call to
printf(3p) with the "%.*s" formatter we have converted the code to
instead use fwrite(3p), which accepts the length as a `size_t`.

It was reported though that this makes us read over the end of the OID
array when the provided `--abbrev=` length exceeds the length of the
object ID. This is because fwrite(3p) of course doesn't stop when it
sees a NUL byte, whereas printf(3p) does.

Fix the bug by reverting back to printf(3p) and culling the provided
length to `GIT_MAX_HEXSZ` to keep it from overflowing when cast to an
`int`.

Reported-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Patrick Steinhardt
2025-01-10 12:26:17 +01:00
committed by Junio C Hamano
parent e03d2a9ccb
commit 1fbb8d7ecb
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
builtin/blame.c
View File

@@ -505,7 +505,8 @@ static void emit_other(struct blame_scoreboard *sb, struct blame_entry *ent, int
length--; length--;
putchar('?'); putchar('?');
} }
fwrite(hex, 1, length, stdout);
printf("%.*s", (int)(length < GIT_MAX_HEXSZ ? length : GIT_MAX_HEXSZ), hex);
if (opt & OUTPUT_ANNOTATE_COMPAT) { if (opt & OUTPUT_ANNOTATE_COMPAT) {
const char *name; const char *name;
if (opt & OUTPUT_SHOW_EMAIL) if (opt & OUTPUT_SHOW_EMAIL)

8
t/t8002-blame.sh
View File

@@ -126,6 +126,14 @@ test_expect_success '--no-abbrev works like --abbrev with full length' '
check_abbrev $hexsz --no-abbrev check_abbrev $hexsz --no-abbrev
' '
test_expect_success 'blame --abbrev gets truncated' '
check_abbrev $hexsz --abbrev=9000 HEAD
'
test_expect_success 'blame --abbrev gets truncated with boundary commit' '
check_abbrev $hexsz --abbrev=9000 ^HEAD
'
test_expect_success '--exclude-promisor-objects does not BUG-crash' ' test_expect_success '--exclude-promisor-objects does not BUG-crash' '
test_must_fail git blame --exclude-promisor-objects one test_must_fail git blame --exclude-promisor-objects one
' '