From 614b19542f649945774a084f2bcf56191f46947c Mon Sep 17 00:00:00 2001 From: Jeff King Date: Fri, 24 Mar 2017 13:25:22 -0400 Subject: fast-import: use xsnprintf for writing sha1s When we have to write a sha1 with a newline, we do so by copying both into a single buffer, so that we can issue a single write() call. We use snprintf but don't bother to check the output, since we know it will fit. However, we should use xsnprintf() in such a case so that we're notified if our assumption turns out to be wrong (and to make it easier to audit for unchecked snprintf calls). Signed-off-by: Jeff King Signed-off-by: Junio C Hamano diff --git a/fast-import.c b/fast-import.c index 64fe602..9ae2053 100644 --- a/fast-import.c +++ b/fast-import.c @@ -3003,7 +3003,7 @@ static void parse_get_mark(const char *p) if (!oe) die("Unknown mark: %s", command_buf.buf); - snprintf(output, sizeof(output), "%s\n", sha1_to_hex(oe->idx.sha1)); + xsnprintf(output, sizeof(output), "%s\n", sha1_to_hex(oe->idx.sha1)); cat_blob_write(output, 41); } -- cgit v0.10.2-6-g49f6 From 98718242cfd18f106dfcd7663282fb9906fd38a5 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Fri, 24 Mar 2017 13:26:24 -0400 Subject: fast-import: use xsnprintf for formatting headers The stream_blob() function checks the return value of snprintf and dies. This is more simply done with xsnprintf (and matches the similar call in store_object). The message the user would get is less specific, but since the point is that this _shouldn't_ ever happen, that's OK. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano diff --git a/fast-import.c b/fast-import.c index 9ae2053..87c4e7e 100644 --- a/fast-import.c +++ b/fast-import.c @@ -1237,9 +1237,7 @@ static void stream_blob(uintmax_t len, unsigned char *sha1out, uintmax_t mark) sha1file_checkpoint(pack_file, &checkpoint); offset = checkpoint.offset; - hdrlen = snprintf((char *)out_buf, out_sz, "blob %" PRIuMAX, len) + 1; - if (out_sz <= hdrlen) - die("impossibly large object header"); + hdrlen = xsnprintf((char *)out_buf, out_sz, "blob %" PRIuMAX, len) + 1; git_SHA1_Init(&c); git_SHA1_Update(&c, out_buf, hdrlen); -- cgit v0.10.2-6-g49f6 From 7202a6fa8773fdcf3f374625def3c15276250b67 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Fri, 24 Mar 2017 13:26:40 -0400 Subject: encode_in_pack_object_header: respect output buffer length The encode_in_pack_object_header() writes a variable-length header to an output buffer, but it doesn't actually know long the buffer is. At first glance, this looks like it might be possible to overflow. In practice, this is probably impossible. The smallest buffer we use is 10 bytes, which would hold the header for an object up to 2^67 bytes. Obviously we're not likely to see such an object, but we might worry that an object could lie about its size (causing us to overflow before we realize it does not actually have that many bytes). But the argument is passed as a uintmax_t. Even on systems that have __int128 available, uintmax_t is typically restricted to 64-bit by the ABI. So it's unlikely that a system exists where this could be exploited. Still, it's easy enough to use a normal out/len pair and make sure we don't write too far. That protects the hypothetical 128-bit system, makes it harder for callers to accidentally specify a too-small buffer, and makes the resulting code easier to audit. Note that the one caller in fast-import tried to catch such a case, but did so _after_ the call (at which point we'd have already overflowed!). This check can now go away. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c index 8841f8b..463f30b 100644 --- a/builtin/pack-objects.c +++ b/builtin/pack-objects.c @@ -286,7 +286,8 @@ static unsigned long write_no_reuse_object(struct sha1file *f, struct object_ent * The object header is a byte of 'type' followed by zero or * more bytes of length. */ - hdrlen = encode_in_pack_object_header(type, size, header); + hdrlen = encode_in_pack_object_header(header, sizeof(header), + type, size); if (type == OBJ_OFS_DELTA) { /* @@ -358,7 +359,8 @@ static off_t write_reuse_object(struct sha1file *f, struct object_entry *entry, if (entry->delta) type = (allow_ofs_delta && entry->delta->idx.offset) ? OBJ_OFS_DELTA : OBJ_REF_DELTA; - hdrlen = encode_in_pack_object_header(type, entry->size, header); + hdrlen = encode_in_pack_object_header(header, sizeof(header), + type, entry->size); offset = entry->in_pack_offset; revidx = find_pack_revindex(p, offset); diff --git a/bulk-checkin.c b/bulk-checkin.c index 991b4a1..ddb6070 100644 --- a/bulk-checkin.c +++ b/bulk-checkin.c @@ -105,7 +105,7 @@ static int stream_to_pack(struct bulk_checkin_state *state, git_deflate_init(&s, pack_compression_level); - hdrlen = encode_in_pack_object_header(type, size, obuf); + hdrlen = encode_in_pack_object_header(obuf, sizeof(obuf), type, size); s.next_out = obuf + hdrlen; s.avail_out = sizeof(obuf) - hdrlen; diff --git a/fast-import.c b/fast-import.c index 87c4e7e..c4ccb3c 100644 --- a/fast-import.c +++ b/fast-import.c @@ -1173,7 +1173,8 @@ static int store_object( delta_count_by_type[type]++; e->depth = last->depth + 1; - hdrlen = encode_in_pack_object_header(OBJ_OFS_DELTA, deltalen, hdr); + hdrlen = encode_in_pack_object_header(hdr, sizeof(hdr), + OBJ_OFS_DELTA, deltalen); sha1write(pack_file, hdr, hdrlen); pack_size += hdrlen; @@ -1184,7 +1185,8 @@ static int store_object( pack_size += sizeof(hdr) - pos; } else { e->depth = 0; - hdrlen = encode_in_pack_object_header(type, dat->len, hdr); + hdrlen = encode_in_pack_object_header(hdr, sizeof(hdr), + type, dat->len); sha1write(pack_file, hdr, hdrlen); pack_size += hdrlen; } @@ -1246,9 +1248,7 @@ static void stream_blob(uintmax_t len, unsigned char *sha1out, uintmax_t mark) git_deflate_init(&s, pack_compression_level); - hdrlen = encode_in_pack_object_header(OBJ_BLOB, len, out_buf); - if (out_sz <= hdrlen) - die("impossibly large object header"); + hdrlen = encode_in_pack_object_header(out_buf, out_sz, OBJ_BLOB, len); s.next_out = out_buf + hdrlen; s.avail_out = out_sz - hdrlen; diff --git a/pack-write.c b/pack-write.c index 88bc7f9..c057513 100644 --- a/pack-write.c +++ b/pack-write.c @@ -304,7 +304,8 @@ char *index_pack_lockfile(int ip_out) * - each byte afterwards: low seven bits are size continuation, * with the high bit being "size continues" */ -int encode_in_pack_object_header(enum object_type type, uintmax_t size, unsigned char *hdr) +int encode_in_pack_object_header(unsigned char *hdr, int hdr_len, + enum object_type type, uintmax_t size) { int n = 1; unsigned char c; @@ -315,6 +316,8 @@ int encode_in_pack_object_header(enum object_type type, uintmax_t size, unsigned c = (type << 4) | (size & 15); size >>= 4; while (size) { + if (n == hdr_len) + die("object size is too enormous to format"); *hdr++ = c | 0x80; c = size & 0x7f; size >>= 7; diff --git a/pack.h b/pack.h index 0e77429..87e456d 100644 --- a/pack.h +++ b/pack.h @@ -84,7 +84,8 @@ extern int verify_pack(struct packed_git *, verify_fn fn, struct progress *, uin extern off_t write_pack_header(struct sha1file *f, uint32_t); extern void fixup_pack_header_footer(int, unsigned char *, const char *, uint32_t, unsigned char *, off_t); extern char *index_pack_lockfile(int fd); -extern int encode_in_pack_object_header(enum object_type, uintmax_t, unsigned char *); +extern int encode_in_pack_object_header(unsigned char *hdr, int hdr_len, + enum object_type, uintmax_t); #define PH_ERROR_EOF (-1) #define PH_ERROR_PACK_SIGNATURE (-2) -- cgit v0.10.2-6-g49f6 From 2c5e2865cc3dfc053e71510415f479e165119d04 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Fri, 24 Mar 2017 13:26:50 -0400 Subject: pack.h: define largest possible encoded object size Several callers use fixed buffers for storing the pack object header, and they've picked 10 as a magic number. This is reasonable, since it handles objects up to 2^67. But let's give them a constant so it's clear that the number isn't pulled out of thin air. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c index 463f30b..28e7498 100644 --- a/builtin/pack-objects.c +++ b/builtin/pack-objects.c @@ -239,7 +239,8 @@ static unsigned long write_no_reuse_object(struct sha1file *f, struct object_ent unsigned long limit, int usable_delta) { unsigned long size, datalen; - unsigned char header[10], dheader[10]; + unsigned char header[MAX_PACK_OBJECT_HEADER], + dheader[MAX_PACK_OBJECT_HEADER]; unsigned hdrlen; enum object_type type; void *buf; @@ -353,7 +354,8 @@ static off_t write_reuse_object(struct sha1file *f, struct object_entry *entry, off_t offset; enum object_type type = entry->type; off_t datalen; - unsigned char header[10], dheader[10]; + unsigned char header[MAX_PACK_OBJECT_HEADER], + dheader[MAX_PACK_OBJECT_HEADER]; unsigned hdrlen; if (entry->delta) diff --git a/pack.h b/pack.h index 87e456d..5c21587 100644 --- a/pack.h +++ b/pack.h @@ -84,6 +84,12 @@ extern int verify_pack(struct packed_git *, verify_fn fn, struct progress *, uin extern off_t write_pack_header(struct sha1file *f, uint32_t); extern void fixup_pack_header_footer(int, unsigned char *, const char *, uint32_t, unsigned char *, off_t); extern char *index_pack_lockfile(int fd); + +/* + * The "hdr" output buffer should be at least this big, which will handle sizes + * up to 2^67. + */ +#define MAX_PACK_OBJECT_HEADER 10 extern int encode_in_pack_object_header(unsigned char *hdr, int hdr_len, enum object_type, uintmax_t); -- cgit v0.10.2-6-g49f6