mirror of
https://github.com/git/git
synced 2024-08-28 12:09:19 +00:00
![SZEDER Gábor](/assets/img/avatar_default.png)
'git {log,diff,...} -S<...> --pickaxe-regex' can segfault as a result of out-of-bounds memory reads. diffcore-pickaxe.c:contains() looks for all matches of the given regex in a buffer in a loop, advancing the buffer pointer to the end of the last match in each iteration. When we switched to REG_STARTEND inb7d36ffca
(regex: use regexec_buf(), 2016-09-21), we started passing the size of that buffer to the regexp engine, too. Unfortunately, this buffer size is never updated on subsequent iterations, and as the buffer pointer advances on each iteration, this "bufptr+bufsize" points past the end of the buffer. This results in segmentation fault, if that memory can't be accessed. In case of 'git log' it can also result in erroneously listed commits, if the memory past the end of buffer is accessible and happens to contain data matching the regex. Reduce the buffer size on each iteration as the buffer pointer is advanced, thus maintaining the correct end of buffer location. Furthermore, make sure that the buffer pointer is not dereferenced in the control flow statements when we already reached the end of the buffer. The new test is flaky, I've never seen it fail on my Linux box even without the fix, but this is expected according todb5dfa3
(regex: -G<pattern> feeds a non NUL-terminated string to regexec() and fails, 2016-09-21). However, it did fail on Travis CI with the first (and incomplete) version of the fix, and based on that commit message I would expect the new test without the fix to fail most of the time on Windows. Signed-off-by: SZEDER Gábor <szeder.dev@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
28 lines
555 B
Bash
Executable file
28 lines
555 B
Bash
Executable file
#!/bin/sh
|
|
#
|
|
# Copyright (c) 2016 Johannes Schindelin
|
|
#
|
|
|
|
test_description='Pickaxe options'
|
|
|
|
. ./test-lib.sh
|
|
|
|
test_expect_success setup '
|
|
test_commit initial &&
|
|
printf "%04096d" 0 >4096-zeroes.txt &&
|
|
git add 4096-zeroes.txt &&
|
|
test_tick &&
|
|
git commit -m "A 4k file"
|
|
'
|
|
test_expect_success '-G matches' '
|
|
git diff --name-only -G "^0{4096}$" HEAD^ >out &&
|
|
test 4096-zeroes.txt = "$(cat out)"
|
|
'
|
|
|
|
test_expect_success '-S --pickaxe-regex' '
|
|
git diff --name-only -S0 --pickaxe-regex HEAD^ >out &&
|
|
verbose test 4096-zeroes.txt = "$(cat out)"
|
|
'
|
|
|
|
test_done
|