Taylor Blau 5747c8072b contrib/credential: avoid fixed-size buffer in osxkeychain ... The macOS Keychain-based credential helper reads the newline-delimited protocol stream one line at a time by repeatedly calling fgets() into a fixed-size buffer, and is thus affected by the vulnerability described in the previous commit. To mitigate this attack, avoid using a fixed-size buffer, and instead rely on getline() to allocate a buffer as large as necessary to fit the entire content of the line, preventing any protocol injection. We solved a similar problem in a5bb10fd5e (config: avoid fixed-sized buffer when renaming/deleting a section, 2023-04-06) by switching to strbuf_getline(). We can't do that here because the contrib helpers do not link with the rest of Git, and so can't use a strbuf. But we can use the system getline() directly, which works similarly. In most parts of Git we don't assume that every platform has getline(). But this helper is run only on OS X, and that platform added support in 10.7 ("Lion") which was released in 2011. Tested-by: Taylor Blau <me@ttaylorr.com> Co-authored-by: Jeff King <peff@peff.net> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Taylor Blau <me@ttaylorr.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>		2023-05-01 09:27:01 -07:00
..
.gitignore	contrib: add credential helper for OS X Keychain	2011-12-12 16:09:39 -08:00
git-credential-osxkeychain.c	contrib/credential: avoid fixed-size buffer in osxkeychain	2023-05-01 09:27:01 -07:00
Makefile	osxkeychain: pull make config from top-level directory	2012-05-24 10:35:40 -07:00