mirror of
https://github.com/git/git
synced 2024-10-28 19:25:47 +00:00
Merge branch 'rs/nth-parent-parse'
The object name parser for "Nth parent" syntax has been made more robust against integer overflows. * rs/nth-parent-parse: sha1-name: check for overflow of N in "foo^N" and "foo~N" rev-parse: demonstrate overflow of N for "foo^N" and "foo~N"
This commit is contained in:
commit
773521df26
2 changed files with 20 additions and 3 deletions
15
sha1-name.c
15
sha1-name.c
|
@ -1160,13 +1160,22 @@ static enum get_oid_result get_oid_1(struct repository *r,
|
||||||
}
|
}
|
||||||
|
|
||||||
if (has_suffix) {
|
if (has_suffix) {
|
||||||
int num = 0;
|
unsigned int num = 0;
|
||||||
int len1 = cp - name;
|
int len1 = cp - name;
|
||||||
cp++;
|
cp++;
|
||||||
while (cp < name + len)
|
while (cp < name + len) {
|
||||||
num = num * 10 + *cp++ - '0';
|
unsigned int digit = *cp++ - '0';
|
||||||
|
if (unsigned_mult_overflows(num, 10))
|
||||||
|
return MISSING_OBJECT;
|
||||||
|
num *= 10;
|
||||||
|
if (unsigned_add_overflows(num, digit))
|
||||||
|
return MISSING_OBJECT;
|
||||||
|
num += digit;
|
||||||
|
}
|
||||||
if (!num && len1 == len - 1)
|
if (!num && len1 == len - 1)
|
||||||
num = 1;
|
num = 1;
|
||||||
|
else if (num > INT_MAX)
|
||||||
|
return MISSING_OBJECT;
|
||||||
if (has_suffix == '^')
|
if (has_suffix == '^')
|
||||||
return get_parent(r, name, len1, oid, num);
|
return get_parent(r, name, len1, oid, num);
|
||||||
/* else if (has_suffix == '~') -- goes without saying */
|
/* else if (has_suffix == '~') -- goes without saying */
|
||||||
|
|
|
@ -214,4 +214,12 @@ test_expect_success 'arg before dashdash must be a revision (ambiguous)' '
|
||||||
test_cmp expect actual
|
test_cmp expect actual
|
||||||
'
|
'
|
||||||
|
|
||||||
|
test_expect_success 'reject Nth parent if N is too high' '
|
||||||
|
test_must_fail git rev-parse HEAD^100000000000000000000000000000000
|
||||||
|
'
|
||||||
|
|
||||||
|
test_expect_success 'reject Nth ancestor if N is too high' '
|
||||||
|
test_must_fail git rev-parse HEAD~100000000000000000000000000000000
|
||||||
|
'
|
||||||
|
|
||||||
test_done
|
test_done
|
||||||
|
|
Loading…
Reference in a new issue