mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vcs-svn: avoid hangs from corrupt deltas

Browse Source 
A corrupt Subversion-format delta can request reads past the end of
the preimage.  Set sliding_view::max_off so such corruption is caught
when it appears rather than blocking in an impossible-to-fulfill
read() when input is coming from a socket or pipe.

Inspired-by: Ramkumar Ramachandra <artagnon@gmail.com>
Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
This commit is contained in:
Jonathan Nieder
2011-05-27 05:44:27 -05:00
parent abe27c0cbd
commit 3ac10b2e3f
2 changed files with 46 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
vcs-svn/fast_export.c
View File

@ -198,8 +198,7 @@ static long apply_delta(off_t len, struct line_buffer *input,
const char *old_data, uint32_t old_mode)
{
long ret;
off_t preimage_len = 0;
struct sliding_view preimage = SLIDING_VIEW_INIT(&report_buffer, -1);
struct sliding_view preimage = SLIDING_VIEW_INIT(&report_buffer, 0);
FILE *out;
if (init_postimage() || !(out = buffer_tmpfile_rewind(&postimage)))
@ -211,19 +210,23 @@ static long apply_delta(off_t len, struct line_buffer *input,
printf("cat-blob %s\n", old_data);
fflush(stdout);
response = get_response_line();
if (parse_cat_response_line(response, &preimage_len))
if (parse_cat_response_line(response, &preimage.max_off))
die("invalid cat-blob response: %s", response);
check_preimage_overflow(preimage.max_off, 1);
}
if (old_mode == REPO_MODE_LNK) {
strbuf_addstr(&preimage.buf, "link ");
check_preimage_overflow(preimage_len, strlen("link "));
preimage_len += strlen("link ");
check_preimage_overflow(preimage.max_off, strlen("link "));
preimage.max_off += strlen("link ");
check_preimage_overflow(preimage.max_off, 1);
}
if (svndiff0_apply(input, len, &preimage, out))
die("cannot apply delta");
if (old_data) {
/* Read the remainder of preimage and trailing newline. */
if (move_window(&preimage, preimage_len, 1))
assert(!signed_add_overflows(preimage.max_off, 1));
preimage.max_off++; /* room for newline */
if (move_window(&preimage, preimage.max_off - 1, 1))
die("cannot seek to end of input");
if (preimage.buf.buf[0] != '\n')
die("missing newline after cat-blob response");