mirror/ git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2024-05-28 09:16:10 +02:00
Code

builtin/mv: fix out of bounds write 

When commit a88c915 (mv: move submodules using a gitfile, 2013-07-30)
added the submodule_gitfile array, it was not added to the block that
enlarges the arrays when we are moving a directory so that we do not
have to worry about it being a directory when we perform the actual
move.  After this, the loop continues over the enlarged set of sources.

Since we assume that submodule_gitfile has size argc, if any of the
items in the source directory are submodules we are guaranteed to write
beyond the end of submodule_gitfile.

Fix this by realloc'ing submodule_gitfile at the same time as the other
arrays.

Reported-by: Guillaume Gelin <contact@ramnes.eu>
Signed-off-by: John Keeping <john@keeping.me.uk>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
John Keeping 2014-03-08 19:29:17 +00:00 committed by Junio C Hamano
parent 7bbc4e8fdb
commit 89ccc1b09c
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
builtin/mv.c
View File

@ -179,6 +179,9 @@ int cmd_mv(int argc, const char **argv, const char *prefix)
modes = xrealloc(modes,
(argc + last - first)
* sizeof(enum update_mode));
submodule_gitfile = xrealloc(submodule_gitfile,
(argc + last - first)
* sizeof(char *));
}
dst = add_slash(dst);
@ -192,6 +195,7 @@ int cmd_mv(int argc, const char **argv, const char *prefix)
prefix_path(dst, dst_len,
path + length + 1);
modes[argc + j] = INDEX;
submodule_gitfile[argc + j] = NULL;
}
argc += last - first;
}