diff options
| author | Patrick Steinhardt <ps@pks.im> | 2018-10-18 11:43:30 +0200 |
|---|---|---|
| committer | Patrick Steinhardt <ps@pks.im> | 2018-10-18 11:49:23 +0200 |
| commit | 21652ee9de439e042cc2e69b208aa2ef8ce31147 (patch) | |
| tree | 8594d25ff24f9c8a832314e782f619a5f599ae74 /src/tree-cache.c | |
| parent | 68deb2cc80ef19bf3a1915c26b5308b283a6d69a (diff) | |
| download | libgit2-21652ee9de439e042cc2e69b208aa2ef8ce31147.tar.gz | |
tree-cache: avoid out-of-bound reads when parsing trees
We use the `git__strtol32` function to parse the child and entry count
of treecaches from the index, which do not accept a buffer length. As
the buffer that is being passed in is untrusted data and may thus be
malformed and may not contain a terminating `NUL` byte, we can overrun
the buffer and thus perform an out-of-bounds read.
Fix the issue by uzing `git__strntol32` instead.
Diffstat (limited to 'src/tree-cache.c')
| -rw-r--r-- | src/tree-cache.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/tree-cache.c b/src/tree-cache.c index b331d22a2..c33e6af9e 100644 --- a/src/tree-cache.c +++ b/src/tree-cache.c @@ -91,7 +91,7 @@ static int read_tree_internal(git_tree_cache **out, return -1; /* Blank-terminated ASCII decimal number of entries in this tree */ - if (git__strtol32(&count, buffer, &buffer, 10) < 0) + if (git__strntol32(&count, buffer, buffer_end - buffer, &buffer, 10) < 0) goto corrupted; tree->entry_count = count; @@ -100,7 +100,7 @@ static int read_tree_internal(git_tree_cache **out, goto corrupted; /* Number of children of the tree, newline-terminated */ - if (git__strtol32(&count, buffer, &buffer, 10) < 0 || count < 0) + if (git__strntol32(&count, buffer, buffer_end - buffer, &buffer, 10) < 0 || count < 0) goto corrupted; tree->children_count = count; |