Skip to contentSkip to conversation

Don't segfault if the given SHA1 name is longer than 40 characters

PATCH In review [email protected] 2 participants 3 messages Jun 15, 2016

lore
Share & tools
lore

[email protected]

author
#0 lore raw

PATCH 1/1 Don't segfault if the given SHA1 name is longer than 40 characters

Signed-off-by Nguyễn Thái Ngọc Duy <[email protected]>
---
 sha1_name.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
sha1_name.c +1 -1
index 9b226e3..6ffee22 100644
@@ -157,7 +157,7 @@ static int get_short_sha1(const char *na
 	char canonical[40];
 	unsigned char res[20];
 
-	if (len < MINIMUM_ABBREV)
+	if (len < MINIMUM_ABBREV || len > 40)
 		return -1;
 	hashclr(res);
 	memset(canonical, 'x', 40);
Signature · 1 line
1.4.3.rc2.g0503-dirty
#1 lore raw
Quoted 10 lines · [email protected] writes:
Signed-off-by Nguyễn Thái Ngọc Duy <[email protected]>
---
 sha1_name.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
sha1_name.c +0 -0
index 9b226e3..6ffee22 100644

sha1_name.c static int get_short_sha1(const char *na · line 163

Quoted 8 lines
sha1_name.c +1 -1
@@ -157,7 +157,7 @@ static int get_short_sha1(const char *na
 	char canonical[40];
 	unsigned char res[20];
 
-	if (len < MINIMUM_ABBREV)
+	if (len < MINIMUM_ABBREV || len > 40)
 		return -1;
 	hashclr(res);
 	memset(canonical, 'x', 40);

Thanks.

The patch is correct, but it needs a better explanation in the proposed commit log message than just "Don't segfault".

get_describe_name() can be fed a string foo-gXXX...XXX with a very looooooooong hexstring. It calls get_short_sha1() without checking if XXX...XXX part is longer than 40-bytes (in which case it cannot be a valid object name).

get_sha1_1() has the same problem. Given a hexstring longer than 40-bytes, it calls the function with it because earlier ones such as get_sha1_hex() would reject the input.

author
#2 lore raw
Quoted 2 lines · Junio C Hamano

The patch is correct, but it needs a better explanation in the proposed commit log message than just "Don't segfault".

Well, maybe because I got a segfault when I accidentally pasted an sha1 twice (blame my mouse). I hadn't looked closely enough to the bug. Anyway, you got the bug and obviously have a better explanation than mine. Please fix it with a better explanation. I'll be more explanatory next time. Thank you :-)

Quoted 8 lines

get_describe_name() can be fed a string foo-gXXX...XXX with a very looooooooong hexstring. It calls get_short_sha1() without checking if XXX...XXX part is longer than 40-bytes (in which case it cannot be a valid object name).

get_sha1_1() has the same problem. Given a hexstring longer than 40-bytes, it calls the function with it because earlier ones such as get_sha1_hex() would reject the input.

Signature · 1 line
Duy