worktree: Fix out of bounds read that causes data loss and reject invalid empty input in worktree add
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest2 patches 4 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/2 | worktree: don't read out of boundsbuiltin/ | +11 | 2 replies | |
| 2/2 | worktree: reject empty stringbuiltin/ | +2 | 2 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH 0/2] worktree: Fix out of bounds read that causes data loss and reject invalid empty input in worktree add
Passing an empty string to git worktree add (typically via an unset variable, e.g. git worktree add "$UNSET_VAR" -b tb origin/main) can result in BUG: How come '' becomes empty after sanitization? but it can also have worse consequences: recursively deleting the current working directory, including .git. The inconsistent behaviour is caused by worktree_basename reading unrelated bytes from the memory before path and passing that back to add_worktree, which can circumvent the check for the BUG call.
Matthias Aßhauer (2):
worktree: don't read out of bounds
worktree: reject empty string
builtin/worktree.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
base-commit: 9a0c4701dcd5725c4184599322b52933ff5005ca
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-2187%2Frimrul%2Fworktree-fix-oob-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-2187/rimrul/worktree-fix-oob-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/2187
Signature · 1 line
gitgitgadget