mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'js/regexec-buf' into maint

Browse Source 
Some codepaths in "git diff" used regexec(3) on a buffer that was
mmap(2)ed, which may not have a terminating NUL, leading to a read
beyond the end of the mapped region.  This was fixed by introducing
a regexec_buf() helper that takes a <ptr,len> pair with REG_STARTEND
extension.

* js/regexec-buf:
  regex: use regexec_buf()
  regex: add regexec_buf() that can work on a non NUL-terminated string
  regex: -G<pattern> feeds a non NUL-terminated string to regexec() and fails
This commit is contained in:
Junio C Hamano
2016-09-29 16:49:44 -07:00
parent d336b67568 b7d36ffca0
commit 300e95f7df
7 changed files with 53 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
xdiff-interface.c
View File

@ -214,11 +214,10 @@ struct ff_regs {
static long ff_regexp(const char *line, long len,
char *buffer, long buffer_size, void *priv)
{
char *line_buffer;
struct ff_regs *regs = priv;
regmatch_t pmatch[2];
int i;
int result = -1;
int result;
/* Exclude terminating newline (and cr) from matching */
if (len > 0 && line[len-1] == '\n') {
@ -228,18 +227,16 @@ static long ff_regexp(const char *line, long len,
len--;
}
line_buffer = xstrndup(line, len); /* make NUL terminated */
for (i = 0; i < regs->nr; i++) {
struct ff_reg *reg = regs->array + i;
if (!regexec(&reg->re, line_buffer, 2, pmatch, 0)) {
if (!regexec_buf(&reg->re, line, len, 2, pmatch, 0)) {
if (reg->negate)
goto fail;
return -1;
break;
}
}
if (regs->nr <= i)
goto fail;
return -1;
i = pmatch[1].rm_so >= 0 ? 1 : 0;
line += pmatch[i].rm_so;
result = pmatch[i].rm_eo - pmatch[i].rm_so;
@ -248,8 +245,6 @@ static long ff_regexp(const char *line, long len,
while (result > 0 && (isspace(line[result - 1])))
result--;
memcpy(buffer, line, result);
fail:
free(line_buffer);
return result;
}