mirror/ git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-04-28 08:35:23 +02:00
Code

patch-delta: fix oob read 

If `cmd` is in the range [0x01,0x7f] and `cmd > top-data`, the
`memcpy(out, data, cmd)` can copy out-of-bounds data from after `delta_buf`
into `dst_buf`.

This is not an exploitable bug because triggering the bug increments the
`data` pointer beyond `top`, causing the `data != top` sanity check after
the loop to trigger and discard the destination buffer - which means that
the result of the out-of-bounds read is never used for anything.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Nicolas Pitre <nico@fluxnic.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Jann Horn 2018-08-30 03:09:45 -04:00 committed by Junio C Hamano
parent 9caf0107a8
commit 21870efc4a
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
patch-delta.c
View File

@ -56,7 +56,7 @@ void *patch_delta(const void *src_buf, unsigned long src_size,
out += cp_size;
size -= cp_size;
} else if (cmd) {
if (cmd > size)
if (cmd > size || cmd > top - data)
break;
memcpy(out, data, cmd);
out += cmd;

2
t/t5303-pack-corruption-resilience.sh
View File

@ -341,7 +341,7 @@ test_expect_success \
# \0 - empty base
# \2 - two bytes in result
# \2 - two literal bytes (we are short one)
test_expect_failure \
test_expect_success \
'apply delta with too few literal bytes' \
'printf "\0\2\2X" > truncated_delta &&
test_must_fail test-tool delta -p /dev/null truncated_delta /dev/null'