mirror of
https://github.com/git/git
synced 2024-08-25 02:35:46 +00:00
unpack_sha1_header(): detect malformed object header
When opening a loose object file, we often do this sequence: - prepare a short buffer for the object header (on stack) - call unpack_sha1_header() and have early part of the object data inflated, enough to fill the buffer - parse that data in the short buffer, assuming that the first part of the object is <typename> SP <length> NUL Because the parsing function parse_sha1_header_extended() is not given the number of bytes inflated into the header buffer, it you craft a file whose early part inflates a garbage sequence without SP or NUL, and replace a loose object with it, it will end up reading past the end of the inflated data. To correct this, do the following four things: - rename unpack_sha1_header() to unpack_sha1_short_header() and have unpack_sha1_header_to_strbuf() keep calling that as its helper function. This will detect and report zlib errors, but is not aware of the format of a loose object (as before). - introduce unpack_sha1_header() that calls the same helper function, and when zlib reports it inflated OK into the buffer, check if the inflated data has NUL. This would ensure that parsing function will terminate within the buffer that holds the inflated header. - update unpack_sha1_header_to_strbuf() to check if the resulting buffer has NUL for the same effect. - update parse_sha1_header_extended() to make sure that its loop to find the SP that terminates the <typename> stops at NUL. Essentially, this makes unpack_*() functions that are asked to unpack a loose object header to be a bit more strict and detect an input that cannot possibly be a valid object header, even before the parsing function kicks in. Reported-by: Gustavo Grieco <gustavo.grieco@imag.fr> Helped-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
parent
97026fe9a6
commit
d21f842690
26
sha1_file.c
26
sha1_file.c
|
@ -1566,7 +1566,9 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf,
|
|||
return used;
|
||||
}
|
||||
|
||||
int unpack_sha1_header(git_zstream *stream, unsigned char *map, unsigned long mapsize, void *buffer, unsigned long bufsiz)
|
||||
static int unpack_sha1_short_header(git_zstream *stream,
|
||||
unsigned char *map, unsigned long mapsize,
|
||||
void *buffer, unsigned long bufsiz)
|
||||
{
|
||||
/* Get the data stream */
|
||||
memset(stream, 0, sizeof(*stream));
|
||||
|
@ -1579,13 +1581,31 @@ int unpack_sha1_header(git_zstream *stream, unsigned char *map, unsigned long ma
|
|||
return git_inflate(stream, 0);
|
||||
}
|
||||
|
||||
int unpack_sha1_header(git_zstream *stream,
|
||||
unsigned char *map, unsigned long mapsize,
|
||||
void *buffer, unsigned long bufsiz)
|
||||
{
|
||||
int status = unpack_sha1_short_header(stream, map, mapsize,
|
||||
buffer, bufsiz);
|
||||
|
||||
if (status < Z_OK)
|
||||
return status;
|
||||
|
||||
/* Make sure we have the terminating NUL */
|
||||
if (!memchr(buffer, '\0', stream->next_out - (unsigned char *)buffer))
|
||||
return -1;
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int unpack_sha1_header_to_strbuf(git_zstream *stream, unsigned char *map,
|
||||
unsigned long mapsize, void *buffer,
|
||||
unsigned long bufsiz, struct strbuf *header)
|
||||
{
|
||||
int status;
|
||||
|
||||
status = unpack_sha1_header(stream, map, mapsize, buffer, bufsiz);
|
||||
status = unpack_sha1_short_header(stream, map, mapsize, buffer, bufsiz);
|
||||
if (status < Z_OK)
|
||||
return -1;
|
||||
|
||||
/*
|
||||
* Check if entire header is unpacked in the first iteration.
|
||||
|
@ -1676,6 +1696,8 @@ static int parse_sha1_header_extended(const char *hdr, struct object_info *oi,
|
|||
*/
|
||||
for (;;) {
|
||||
char c = *hdr++;
|
||||
if (!c)
|
||||
return -1;
|
||||
if (c == ' ')
|
||||
break;
|
||||
type_len++;
|
||||
|
|
Loading…
Reference in a new issue