From 2ed282cc0d541d665dc7561ff962566378328bd6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?= Date: Tue, 21 Apr 2020 06:54:34 +0700 Subject: [PATCH 1/3] t4254: merge 2 steps of a single test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit While we are at it, make sure we run a clean up after testing. In a later patch, we will test for more corrupted patch. Signed-off-by: Đoàn Trần Công Danh Signed-off-by: Junio C Hamano --- t/t4254-am-corrupt.sh | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/t/t4254-am-corrupt.sh b/t/t4254-am-corrupt.sh index fd3bdbfe2c..ddd35498db 100755 --- a/t/t4254-am-corrupt.sh +++ b/t/t4254-am-corrupt.sh @@ -25,10 +25,8 @@ test_expect_success setup ' # fatal: unable to write file '(null)' mode 100644: Bad address # Also, it had the unwanted side-effect of deleting f. test_expect_success 'try to apply corrupted patch' ' - test_must_fail git -c advice.amWorkDir=false am bad-patch.diff 2>actual -' - -test_expect_success 'compare diagnostic; ensure file is still here' ' + test_when_finished "git am --abort" && + test_must_fail git -c advice.amWorkDir=false am bad-patch.diff 2>actual && echo "error: git diff header lacks filename information (line 4)" >expected && test_path_is_file f && test_i18ncmp expected actual From 2a2ff6039606b93ad08d8d377804ddcd0bc41312 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?= Date: Tue, 21 Apr 2020 06:54:35 +0700 Subject: [PATCH 2/3] mailinfo.c: avoid strlen on strings that can contains NUL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We're passing buffer from strbuf to reencode_string, which will call strlen(3) on that buffer, and discard the length of newly created buffer. Then, we compute the length of the return buffer to attach to strbuf. During this process, we introduce a discrimination between mail originally written in utf-8 and other encoding. * if the email was written in utf-8, we leave it as is. If there is a NUL character in that line, we complains loudly: error: a NUL byte in commit log message not allowed. * if the email was written in other encoding, we truncate the data as the NUL character in that line, then we used the truncated line for the metadata. We can do better by reusing all the available information, and call the underlying lower level function that will be called indirectly by reencode_string. By doing this, we will also postpone the NUL character processing to the commit step, which will complains about the faulty metadata. Signed-off-by: Đoàn Trần Công Danh Signed-off-by: Junio C Hamano --- mailinfo.c | 6 ++++-- t/t4254-am-corrupt.sh | 44 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 2 deletions(-) diff --git a/mailinfo.c b/mailinfo.c index 742fa376ab..0e9911df6d 100644 --- a/mailinfo.c +++ b/mailinfo.c @@ -447,19 +447,21 @@ static int convert_to_utf8(struct mailinfo *mi, struct strbuf *line, const char *charset) { char *out; + size_t out_len; if (!mi->metainfo_charset || !charset || !*charset) return 0; if (same_encoding(mi->metainfo_charset, charset)) return 0; - out = reencode_string(line->buf, mi->metainfo_charset, charset); + out = reencode_string_len(line->buf, line->len, + mi->metainfo_charset, charset, &out_len); if (!out) { mi->input_error = -1; return error("cannot convert from %s to %s", charset, mi->metainfo_charset); } - strbuf_attach(line, out, strlen(out), strlen(out)); + strbuf_attach(line, out, out_len, out_len); return 0; } diff --git a/t/t4254-am-corrupt.sh b/t/t4254-am-corrupt.sh index ddd35498db..1bbc37bc92 100755 --- a/t/t4254-am-corrupt.sh +++ b/t/t4254-am-corrupt.sh @@ -3,6 +3,37 @@ test_description='git am with corrupt input' . ./test-lib.sh +make_mbox_with_nul () { + space=' ' + q_nul_in_subject= + q_nul_in_body= + while test $# -ne 0 + do + case "$1" in + subject) q_nul_in_subject='=00' ;; + body) q_nul_in_body='=00' ;; + esac && + shift + done && + cat <<-EOF + From ec7364544f690c560304f5a5de9428ea3b978b26 Mon Sep 17 00:00:00 2001 + From: A U Thor + Date: Sun, 19 Apr 2020 13:42:07 +0700 + Subject: [PATCH] =?ISO-8859-1?q?=C4=CB${q_nul_in_subject}=D1=CF=D6?= + MIME-Version: 1.0 + Content-Type: text/plain; charset=ISO-8859-1 + Content-Transfer-Encoding: quoted-printable + + abc${q_nul_in_body}def + --- + diff --git a/afile b/afile + new file mode 100644 + index 0000000000..e69de29bb2 + --$space + 2.26.1 + EOF +} + test_expect_success setup ' # Note the missing "+++" line: cat >bad-patch.diff <<-\EOF && @@ -32,4 +63,17 @@ test_expect_success 'try to apply corrupted patch' ' test_i18ncmp expected actual ' +test_expect_success "NUL in commit message's body" ' + test_when_finished "git am --abort" && + make_mbox_with_nul body >body.patch && + test_must_fail git am body.patch 2>err && + grep "a NUL byte in commit log message not allowed" err +' + +test_expect_failure "NUL in commit message's header" " + test_when_finished 'git am --abort' && + make_mbox_with_nul subject >subject.patch && + test_must_fail git am subject.patch +" + test_done From 391999744771002cb5feded004879f36534b9b14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?= Date: Tue, 21 Apr 2020 06:54:36 +0700 Subject: [PATCH 3/3] mailinfo: disallow NUL character in mail's header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Đoàn Trần Công Danh Signed-off-by: Junio C Hamano --- mailinfo.c | 5 +++++ t/t4254-am-corrupt.sh | 7 +++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/mailinfo.c b/mailinfo.c index 0e9911df6d..5681d9130d 100644 --- a/mailinfo.c +++ b/mailinfo.c @@ -1138,6 +1138,11 @@ static void handle_info(struct mailinfo *mi) else continue; + if (memchr(hdr->buf, '\0', hdr->len)) { + error("a NUL byte in '%s' is not allowed.", header[i]); + mi->input_error = -1; + } + if (!strcmp(header[i], "Subject")) { if (!mi->keep_subject) { cleanup_subject(mi, hdr); diff --git a/t/t4254-am-corrupt.sh b/t/t4254-am-corrupt.sh index 1bbc37bc92..daf01c309d 100755 --- a/t/t4254-am-corrupt.sh +++ b/t/t4254-am-corrupt.sh @@ -70,10 +70,13 @@ test_expect_success "NUL in commit message's body" ' grep "a NUL byte in commit log message not allowed" err ' -test_expect_failure "NUL in commit message's header" " +test_expect_success "NUL in commit message's header" " test_when_finished 'git am --abort' && make_mbox_with_nul subject >subject.patch && - test_must_fail git am subject.patch + test_must_fail git mailinfo msg patch err && + grep \"a NUL byte in 'Subject' is not allowed\" err && + test_must_fail git am subject.patch 2>err && + grep \"a NUL byte in 'Subject' is not allowed\" err " test_done