mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix invalid read in quote_c_style_counted

Browse Source 
This function did not work on strings that were not NUL-terminated. It
reads through a length-bounded string, searching for characters in need of
quoting. After we find one, we output the quoted character, then advance
our pointer to find the next one. However, we never decremented the
length, meaning we ended up looking at whatever random junk was stored
after the string.

This bug was not found by the existing tests because most code paths feed
a NUL-terminated string. The notable exception is a directory name being
fed by ls-tree.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Jeff King
2010-02-01 08:39:03 -05:00
committed by Junio C Hamano
parent d2d66f15b6
commit 8424981934
2 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
quote.c
View File

@ -213,7 +213,7 @@ static size_t quote_c_style_counted(const char *name, ssize_t maxlen,
int ch;
len = next_quote_pos(p, maxlen);
if (len == maxlen || !p[len])
if (len == maxlen || (maxlen < 0 && !p[len]))
break;
if (!no_dq && p == name)
@ -223,6 +223,8 @@ static size_t quote_c_style_counted(const char *name, ssize_t maxlen,
EMIT('\\');
p += len;
ch = (unsigned char)*p++;
if (maxlen >= 0)
maxlen -= len + 1;
if (sq_lookup[ch] >= ' ') {
EMIT(sq_lookup[ch]);
} else {