mirror/git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-11-18 02:53:55 +01:00
Code

Fix broken sha1 locking

Browse Source 
Current git#next is totally broken wrt. cloning over HTTP, generating refs
at random directories. Of course it's caused by the static get_pathname()
buffer. lock_ref_sha1() stores return value of mkpath()'s get_pathname()
call, then calls lock_ref_sha1_basic() which calls git_path(ref) which
calls get_pathname() at that point returning pointer to the same buffer.
So now you are sprintf()ing a format string into itself, wow! The resulting
pathnames are really cute. (If you've been paying attention, yes, the
mere fact that a format string _could_ write over itself is very wrong
and probably exploitable here. See the other mail I've just sent.)

I've never liked how we use return values of those functions so liberally,
the "allow some random number of get_pathname() return values to work
concurrently" is absolutely horrible pit and we've already fallen in this
before IIRC. I consider it an awful coding practice, you add a call
somewhere and at some other point some distant caller of that breaks since
it reuses the same return values. Not to mention this takes quite some time
to debug.

My gut feeling tells me that there might be more of this.  I don't have
time to review the rest of the users of the refs.c functions though.

Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This commit is contained in:
Petr Baudis 2006-09-19 22:58:23 +02:00 committed by Junio C Hamano
parent 5b10b09113
commit 53cce84c05
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
refs.c
View File

@ -462,10 +462,12 @@ static struct ref_lock *lock_ref_sha1_basic(const char *ref,
struct ref_lock *lock_ref_sha1(const char *ref, struct ref_lock *lock_ref_sha1(const char *ref,
const unsigned char *old_sha1, int mustexist) const unsigned char *old_sha1, int mustexist)
{ {
char refpath[PATH_MAX];
if (check_ref_format(ref)) if (check_ref_format(ref))
return NULL; return NULL;
return lock_ref_sha1_basic(mkpath("refs/%s", ref), strcpy(refpath, mkpath("refs/%s", ref));
5 + strlen(ref), old_sha1, mustexist); return lock_ref_sha1_basic(refpath, strlen(refpath),
old_sha1, mustexist);
} }
struct ref_lock *lock_any_ref_for_update(const char *ref, struct ref_lock *lock_any_ref_for_update(const char *ref,