summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJeff King <peff@peff.net>2016-02-19 11:21:30 (GMT)
committerJunio C Hamano <gitster@pobox.com>2016-03-16 17:41:02 (GMT)
commitd770187872e8408a8e4c0533cf6e6913776882b0 (patch)
tree34d686142d5a3c7136a6f9bc6571583d7d8e124c
parent935de81289cd04b4736c538747c53df123c30d1c (diff)
downloadgit-d770187872e8408a8e4c0533cf6e6913776882b0.zip
git-d770187872e8408a8e4c0533cf6e6913776882b0.tar.gz
git-d770187872e8408a8e4c0533cf6e6913776882b0.tar.bz2
tree-diff: catch integer overflow in combine_diff_path allocation
A combine_diff_path struct has two "flex" members allocated alongside the struct: a string to hold the pathname, and an array of parent pointers. We use an "int" to compute this, meaning we may easily overflow it if the pathname is extremely long. We can fix this by using size_t, and checking for overflow with the st_add helper. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
-rw-r--r--diff.h4
-rw-r--r--tree-diff.c4
2 files changed, 4 insertions, 4 deletions
diff --git a/diff.h b/diff.h
index 1ac0582..561635b 100644
--- a/diff.h
+++ b/diff.h
@@ -215,8 +215,8 @@ struct combine_diff_path {
} parent[FLEX_ARRAY];
};
#define combine_diff_path_size(n, l) \
- (sizeof(struct combine_diff_path) + \
- sizeof(struct combine_diff_parent) * (n) + (l) + 1)
+ st_add4(sizeof(struct combine_diff_path), (l), 1, \
+ st_mult(sizeof(struct combine_diff_parent), (n)))
extern void show_combined_diff(struct combine_diff_path *elem, int num_parent,
int dense, struct rev_info *);
diff --git a/tree-diff.c b/tree-diff.c
index e7b378c..4b32d40 100644
--- a/tree-diff.c
+++ b/tree-diff.c
@@ -124,8 +124,8 @@ static struct combine_diff_path *path_appendnew(struct combine_diff_path *last,
unsigned mode, const unsigned char *sha1)
{
struct combine_diff_path *p;
- int len = base->len + pathlen;
- int alloclen = combine_diff_path_size(nparent, len);
+ size_t len = st_add(base->len, pathlen);
+ size_t alloclen = combine_diff_path_size(nparent, len);
/* if last->next is !NULL - it is a pre-allocated memory, we can reuse */
p = last->next;