From 65bb21e77e7f12e215974018b4b1febcb87c85c9 Mon Sep 17 00:00:00 2001 From: Eric Sunshine Date: Thu, 2 Aug 2018 23:07:49 -0700 Subject: [PATCH] color: protect against out-of-bounds reads and writes want_color_fd() is designed to work only with standard output and error file descriptors and stores information about each descriptor in an array. However, it doesn't verify that the passed-in descriptor lives within that set, which, with a buggy caller, could lead to access or assignment outside the array bounds. Signed-off-by: Eric Sunshine Acked-by: Johannes Schindelin Signed-off-by: Jonathan Nieder Signed-off-by: Junio C Hamano --- color.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/color.c b/color.c index b1c24c69de..ebb222ec33 100644 --- a/color.c +++ b/color.c @@ -343,6 +343,9 @@ int want_color_fd(int fd, int var) static int want_auto[3] = { -1, -1, -1 }; + if (fd < 1 || fd >= ARRAY_SIZE(want_auto)) + BUG("file descriptor out of range: %d", fd); + if (var < 0) var = git_use_color_default;