development/git
development/git
1
0
Fork 0
mirror of https://github.com/git/git synced 2024-10-02 14:45:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

prune-packed: use strbuf to avoid having to worry about PATH_MAX

Browse source 
A/very/long/path/to/.git that becomes exactly PATH_MAX bytes long
after suffixed with /objects/??/??38-hex??, would have overflown
the on-stack pathname[] buffer.

Noticed-by:  Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Junio C Hamano 2013-12-17 10:43:30 -08:00
parent d7aced95cd
commit c235d960cb
1 changed files with 21 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
builtin/prune-packed.c
View file

@ -10,58 +10,62 @@ static const char * const prune_packed_usage[] = {
static struct progress *progress;
static void prune_dir(int i, DIR *dir, char *pathname, int len, int opts)
static void prune_dir(int i, DIR *dir, struct strbuf *pathname, int opts)
{
struct dirent *de;
char hex[40];
int top_len = pathname->len;
sprintf(hex, "%02x", i);
while ((de = readdir(dir)) != NULL) {
unsigned char sha1[20];
if (strlen(de->d_name) != 38)
continue;
memcpy(hex+2, de->d_name, 38);
memcpy(hex + 2, de->d_name, 38);
if (get_sha1_hex(hex, sha1))
continue;
if (!has_sha1_pack(sha1))
continue;
memcpy(pathname + len, de->d_name, 38);
strbuf_add(pathname, de->d_name, 38);
if (opts & PRUNE_PACKED_DRY_RUN)
printf("rm -f %s\n", pathname);
printf("rm -f %s\n", pathname->buf);
else
unlink_or_warn(pathname);
unlink_or_warn(pathname->buf);
display_progress(progress, i + 1);
strbuf_setlen(pathname, top_len);
}
}
void prune_packed_objects(int opts)
{
int i;
static char pathname[PATH_MAX];
const char *dir = get_object_directory();
int len = strlen(dir);
struct strbuf pathname = STRBUF_INIT;
int top_len;
strbuf_addstr(&pathname, dir);
if (opts & PRUNE_PACKED_VERBOSE)
progress = start_progress_delay("Removing duplicate objects",
256, 95, 2);
if (len > PATH_MAX - 42)
die("impossible object directory");
memcpy(pathname, dir, len);
if (len && pathname[len-1] != '/')
pathname[len++] = '/';
if (pathname.len && pathname.buf[pathname.len - 1] != '/')
strbuf_addch(&pathname, '/');
top_len = pathname.len;
for (i = 0; i < 256; i++) {
DIR *d;
display_progress(progress, i + 1);
sprintf(pathname + len, "%02x/", i);
d = opendir(pathname);
strbuf_setlen(&pathname, top_len);
strbuf_addf(&pathname, "%02x/", i);
d = opendir(pathname.buf);
if (!d)
continue;
prune_dir(i, d, pathname, len + 3, opts);
prune_dir(i, d, &pathname, opts);
closedir(d);
pathname[len + 2] = '\0';
rmdir(pathname);
strbuf_setlen(&pathname, top_len + 2);
rmdir(pathname.buf);
}
stop_progress(&progress);
}