Skip to content

G
git2
Commit 392702ee by Edward Thomson Committed by Edward Thomson
Options

allocations: test for overflow of requested size 

Introduce some helper macros to test integer overflow from arithmetic
and set error message appropriately.
parent d24a5312
Showing with 528 additions and 117 deletions
src/array.h
......@@ -45,15 +45,28 @@ typedef git_array_t(char) git_array_generic_t;
GIT_INLINE(void *) git_array_grow(void *_a, size_t item_size)
{
volatile git_array_generic_t *a = _a;
uint32_t new_size = (a->size < 8) ? 8 : a->asize * 3 / 2;
char *new_array = git__realloc(a->ptr, new_size * item_size);
if (!new_array) {
git_array_clear(*a);
return NULL;
uint32_t new_size;
char *new_array;
if (a->size < 8) {
new_size = 8;
} else {
a->ptr = new_array; a->asize = new_size; a->size++;
return a->ptr + (a->size - 1) * item_size;
if (GIT_ALLOC_OVERFLOW_MULTIPLY(a->size, 3 / 2))
goto on_oom;
new_size = a->size * 3 / 2;
}
if (GIT_ALLOC_OVERFLOW_MULTIPLY(new_size, item_size) ||
(new_array = git__realloc(a->ptr, new_size * item_size)) == NULL)
goto on_oom;
a->ptr = new_array; a->asize = new_size; a->size++;
return a->ptr + (a->size - 1) * item_size;
on_oom:
git_array_clear(*a);
return NULL;
}
#define git_array_alloc(a) \
......
src/blame.c
......@@ -76,6 +76,10 @@ static git_blame_hunk* dup_hunk(git_blame_hunk *hunk)
hunk->lines_in_hunk,
hunk->orig_start_line_number,
hunk->orig_path);
if (!newhunk)
return NULL;
git_oid_cpy(&newhunk->orig_commit_id, &hunk->orig_commit_id);
git_oid_cpy(&newhunk->final_commit_id, &hunk->final_commit_id);
newhunk->boundary = hunk->boundary;
......@@ -221,6 +225,10 @@ static git_blame_hunk *split_hunk_in_vector(
new_line_count = hunk->lines_in_hunk - rel_line;
nh = new_hunk((uint16_t)(hunk->final_start_line_number+rel_line), (uint16_t)new_line_count,
(uint16_t)(hunk->orig_start_line_number+rel_line), hunk->orig_path);
if (!nh)
return NULL;
git_oid_cpy(&nh->final_commit_id, &hunk->final_commit_id);
git_oid_cpy(&nh->orig_commit_id, &hunk->orig_commit_id);
......@@ -270,6 +278,10 @@ static git_blame_hunk* hunk_from_entry(git_blame__entry *e)
{
git_blame_hunk *h = new_hunk(
e->lno+1, e->num_lines, e->s_lno+1, e->suspect->path);
if (!h)
return NULL;
git_oid_cpy(&h->final_commit_id, git_commit_id(e->suspect->commit));
git_oid_cpy(&h->orig_commit_id, git_commit_id(e->suspect->commit));
git_signature_dup(&h->final_signature, git_commit_author(e->suspect->commit));
......@@ -307,6 +319,8 @@ static int blame_internal(git_blame *blame)
blame->final_buf_size = git_blob_rawsize(blame->final_blob);
ent = git__calloc(1, sizeof(git_blame__entry));
GITERR_CHECK_ALLOC(ent);
ent->num_lines = index_blob_lines(blame);
ent->lno = blame->options.min_line - 1;
ent->num_lines = ent->num_lines - blame->options.min_line + 1;
......@@ -322,8 +336,9 @@ static int blame_internal(git_blame *blame)
cleanup:
for (ent = blame->ent; ent; ) {
git_blame__entry *e = ent->next;
git_blame_hunk *h = hunk_from_entry(ent);
git_vector_insert(&blame->hunks, hunk_from_entry(ent));
git_vector_insert(&blame->hunks, h);
git_blame__free_entry(ent);
ent = e;
......@@ -392,11 +407,14 @@ static int buffer_hunk_cb(
if (!blame->current_hunk) {
/* Line added at the end of the file */
blame->current_hunk = new_hunk(wedge_line, 0, wedge_line, blame->path);
GITERR_CHECK_ALLOC(blame->current_hunk);
git_vector_insert(&blame->hunks, blame->current_hunk);
} else if (!hunk_starts_at_or_after_line(blame->current_hunk, wedge_line)){
/* If this hunk doesn't start between existing hunks, split a hunk up so it does */
blame->current_hunk = split_hunk_in_vector(&blame->hunks, blame->current_hunk,
wedge_line - blame->current_hunk->orig_start_line_number, true);
GITERR_CHECK_ALLOC(blame->current_hunk);
}
return 0;
......@@ -425,6 +443,8 @@ static int buffer_line_cb(
/* Create a new buffer-blame hunk with this line */
shift_hunks_by(&blame->hunks, blame->current_diff_line, 1);
blame->current_hunk = new_hunk((uint16_t)blame->current_diff_line, 1, 0, blame->path);
GITERR_CHECK_ALLOC(blame->current_hunk);
git_vector_insert_sorted(&blame->hunks, blame->current_hunk, NULL);
}
blame->current_diff_line++;
......@@ -464,10 +484,14 @@ int git_blame_buffer(
assert(out && reference && buffer && buffer_len);
blame = git_blame__alloc(reference->repository, reference->options, reference->path);
GITERR_CHECK_ALLOC(blame);
/* Duplicate all of the hunk structures in the reference blame */
git_vector_foreach(&reference->hunks, i, hunk) {
git_vector_insert(&blame->hunks, dup_hunk(hunk));
git_blame_hunk *h = dup_hunk(hunk);
GITERR_CHECK_ALLOC(h);
git_vector_insert(&blame->hunks, h);
}
/* Diff to the reference blob */
......
src/blame_git.c
......@@ -35,10 +35,14 @@ static void origin_decref(git_blame__origin *o)
/* Given a commit and a path in it, create a new origin structure. */
static int make_origin(git_blame__origin **out, git_commit *commit, const char *path)
{
int error = 0;
git_blame__origin *o;
size_t path_len = strlen(path);
int error = 0;
GITERR_CHECK_ALLOC_ADD(sizeof(*o), path_len);
GITERR_CHECK_ALLOC_ADD(sizeof(*o) + path_len, 1);
o = git__calloc(1, sizeof(*o) + strlen(path) + 1);
o = git__calloc(1, sizeof(*o) + path_len + 1);
GITERR_CHECK_ALLOC(o);
o->commit = commit;
o->refcnt = 1;
......
src/buf_text.c
......@@ -29,6 +29,8 @@ int git_buf_text_puts_escaped(
scan += count;
}
GITERR_CHECK_ALLOC_ADD(buf->size, total);
GITERR_CHECK_ALLOC_ADD(buf->size + total, 1);
if (git_buf_grow(buf, buf->size + total + 1) < 0)
return -1;
......@@ -73,8 +75,10 @@ int git_buf_text_crlf_to_lf(git_buf *tgt, const git_buf *src)
return git_buf_set(tgt, src->ptr, src->size);
/* reduce reallocs while in the loop */
GITERR_CHECK_ALLOC_ADD(src->size, 1);
if (git_buf_grow(tgt, src->size + 1) < 0)
return -1;
out = tgt->ptr;
tgt->size = 0;
......@@ -117,13 +121,15 @@ int git_buf_text_lf_to_crlf(git_buf *tgt, const git_buf *src)
return git_buf_set(tgt, src->ptr, src->size);
/* attempt to reduce reallocs while in the loop */
GITERR_CHECK_ALLOC_ADD(src->size, src->size >> 4);
GITERR_CHECK_ALLOC_ADD(src->size + (src->size >> 4), 1);
if (git_buf_grow(tgt, src->size + (src->size >> 4) + 1) < 0)
return -1;
tgt->size = 0;
for (; next; scan = next + 1, next = memchr(scan, '\n', end - scan)) {
size_t copylen = next - scan;
size_t needsize = tgt->size + copylen + 2 + 1;
size_t needsize;
/* if we find mixed line endings, bail */
if (next > start && next[-1] == '\r') {
......@@ -131,6 +137,10 @@ int git_buf_text_lf_to_crlf(git_buf *tgt, const git_buf *src)
return GIT_PASSTHROUGH;
}
GITERR_CHECK_ALLOC_ADD(tgt->size, copylen);
GITERR_CHECK_ALLOC_ADD(tgt->size + copylen, 3);
needsize = tgt->size + copylen + 3;
if (tgt->asize < needsize && git_buf_grow(tgt, needsize) < 0)
return -1;
......
src/buffer.c
......@@ -63,6 +63,14 @@ int git_buf_try_grow(
/* round allocation up to multiple of 8 */
new_size = (new_size + 7) & ~7;
if (new_size < buf->size) {
if (mark_oom)
buf->ptr = git_buf__oom;
giterr_set_oom();
return -1;
}
new_ptr = git__realloc(new_ptr, new_size);
if (!new_ptr) {
......@@ -131,6 +139,7 @@ int git_buf_set(git_buf *buf, const void *data, size_t len)
git_buf_clear(buf);
} else {
if (data != buf->ptr) {
GITERR_CHECK_ALLOC_ADD(len, 1);
ENSURE_SIZE(buf, len + 1);
memmove(buf->ptr, data, len);
}
......@@ -160,6 +169,7 @@ int git_buf_sets(git_buf *buf, const char *string)
int git_buf_putc(git_buf *buf, char c)
{
GITERR_CHECK_ALLOC_ADD(buf->size, 2);
ENSURE_SIZE(buf, buf->size + 2);
buf->ptr[buf->size++] = c;
buf->ptr[buf->size] = '\0';
......@@ -168,6 +178,8 @@ int git_buf_putc(git_buf *buf, char c)
int git_buf_putcn(git_buf *buf, char c, size_t len)
{
GITERR_CHECK_ALLOC_ADD(buf->size, len);
GITERR_CHECK_ALLOC_ADD(buf->size + len, 1);
ENSURE_SIZE(buf, buf->size + len + 1);
memset(buf->ptr + buf->size, c, len);
buf->size += len;
......@@ -179,6 +191,8 @@ int git_buf_put(git_buf *buf, const char *data, size_t len)
{
if (len) {
assert(data);
GITERR_CHECK_ALLOC_ADD(buf->size, len);
GITERR_CHECK_ALLOC_ADD(buf->size + len, 1);
ENSURE_SIZE(buf, buf->size + len + 1);
memmove(buf->ptr + buf->size, data, len);
buf->size += len;
......@@ -201,8 +215,12 @@ int git_buf_encode_base64(git_buf *buf, const char *data, size_t len)
size_t extra = len % 3;
uint8_t *write, a, b, c;
const uint8_t *read = (const uint8_t *)data;
size_t blocks = (len / 3) + !!extra;
ENSURE_SIZE(buf, buf->size + 4 * ((len / 3) + !!extra) + 1);
GITERR_CHECK_ALLOC_MULTIPLY(blocks, 4);
GITERR_CHECK_ALLOC_ADD(buf->size, 4 * blocks);
GITERR_CHECK_ALLOC_ADD(buf->size + 4 * blocks, 1);
ENSURE_SIZE(buf, buf->size + 4 * blocks + 1);
write = (uint8_t *)&buf->ptr[buf->size];
/* convert each run of 3 bytes into 4 output bytes */
......@@ -256,6 +274,8 @@ int git_buf_decode_base64(git_buf *buf, const char *base64, size_t len)
size_t orig_size = buf->size;
assert(len % 4 == 0);
GITERR_CHECK_ALLOC_ADD(buf->size, len / 4 * 3);
GITERR_CHECK_ALLOC_ADD(buf->size + (len / 4 * 3), 1);
ENSURE_SIZE(buf, buf->size + (len / 4 * 3) + 1);
for (i = 0; i < len; i += 4) {
......@@ -284,7 +304,12 @@ static const char b85str[] =
int git_buf_encode_base85(git_buf *buf, const char *data, size_t len)
{
ENSURE_SIZE(buf, buf->size + (5 * ((len / 4) + !!(len % 4))) + 1);
size_t blocks = (len / 4) + !!(len % 4);
GITERR_CHECK_ALLOC_MULTIPLY(blocks, 5);
GITERR_CHECK_ALLOC_ADD(buf->size, 5 * blocks);
GITERR_CHECK_ALLOC_ADD(buf->size + 5 * blocks, 1);
ENSURE_SIZE(buf, buf->size + blocks * 5 + 1);
while (len) {
uint32_t acc = 0;
......@@ -317,8 +342,14 @@ int git_buf_encode_base85(git_buf *buf, const char *data, size_t len)
int git_buf_vprintf(git_buf *buf, const char *format, va_list ap)
{
size_t expected_size = strlen(format);
int len;
const size_t expected_size = buf->size + (strlen(format) * 2);
GITERR_CHECK_ALLOC_MULTIPLY(expected_size, 2);
expected_size *= 2;
GITERR_CHECK_ALLOC_ADD(expected_size, buf->size);
expected_size += buf->size;
ENSURE_SIZE(buf, expected_size);
......@@ -345,6 +376,8 @@ int git_buf_vprintf(git_buf *buf, const char *format, va_list ap)
break;
}
GITERR_CHECK_ALLOC_ADD(buf->size, len);
GITERR_CHECK_ALLOC_ADD(buf->size + len, 1);
ENSURE_SIZE(buf, buf->size + len + 1);
}
......@@ -481,6 +514,9 @@ int git_buf_join_n(git_buf *buf, char separator, int nbuf, ...)
/* expand buffer if needed */
if (total_size == 0)
return 0;
GITERR_CHECK_ALLOC_ADD(buf->size, total_size);
GITERR_CHECK_ALLOC_ADD(buf->size + total_size, 1);
if (git_buf_grow(buf, buf->size + total_size + 1) < 0)
return -1;
......@@ -559,6 +595,9 @@ int git_buf_join(
if (str_a >= buf->ptr && str_a < buf->ptr + buf->size)
offset_a = str_a - buf->ptr;
GITERR_CHECK_ALLOC_ADD(strlen_a, strlen_b);
GITERR_CHECK_ALLOC_ADD(strlen_a + strlen_b, need_sep);
GITERR_CHECK_ALLOC_ADD(strlen_a + strlen_b + need_sep, 1);
if (git_buf_grow(buf, strlen_a + strlen_b + need_sep + 1) < 0)
return -1;
assert(buf->ptr);
......@@ -607,6 +646,11 @@ int git_buf_join3(
sep_b = (str_b[len_b - 1] != separator);
}
GITERR_CHECK_ALLOC_ADD(len_a, sep_a);
GITERR_CHECK_ALLOC_ADD(len_a + sep_a, len_b);
GITERR_CHECK_ALLOC_ADD(len_a + sep_a + len_b, sep_b);
GITERR_CHECK_ALLOC_ADD(len_a + sep_a + len_b + sep_b, len_c);
GITERR_CHECK_ALLOC_ADD(len_a + sep_a + len_b + sep_b + len_c, 1);
if (git_buf_grow(buf, len_a + sep_a + len_b + sep_b + len_c + 1) < 0)
return -1;
......@@ -660,6 +704,8 @@ int git_buf_splice(
const char *data,
size_t nb_to_insert)
{
size_t new_size;
assert(buf &&
where <= git_buf_len(buf) &&
where + nb_to_remove <= git_buf_len(buf));
......@@ -667,7 +713,13 @@ int git_buf_splice(
/* Ported from git.git
* https://github.com/git/git/blob/16eed7c/strbuf.c#L159-176
*/
ENSURE_SIZE(buf, buf->size + nb_to_insert - nb_to_insert + 1);
new_size = buf->size - nb_to_remove;
GITERR_CHECK_ALLOC_ADD(new_size, nb_to_insert);
new_size += nb_to_insert;
GITERR_CHECK_ALLOC_ADD(new_size, 1);
ENSURE_SIZE(buf, new_size + 1);
memmove(buf->ptr + where + nb_to_insert,
buf->ptr + where + nb_to_remove,
......@@ -675,7 +727,7 @@ int git_buf_splice(
memcpy(buf->ptr + where, data, nb_to_insert);
buf->size = buf->size + nb_to_insert - nb_to_remove;
buf->size = new_size;
buf->ptr[buf->size] = '\0';
return 0;
}
src/common.h
......@@ -174,6 +174,28 @@ GIT_INLINE(void) git__init_structure(void *structure, size_t len, unsigned int v
GITERR_CHECK_VERSION(&(VERSION), _tmpl.version, #TYPE); \
memcpy((PTR), &_tmpl, sizeof(_tmpl)); } while (0)
/** Check for integer overflow from addition or multiplication */
#define GIT_ALLOC_OVERFLOW_ADD(one, two) \
((one) + (two) < (one))
/** Check for integer overflow from multiplication */
#define GIT_ALLOC_OVERFLOW_MULTIPLY(one, two) \
(one && ((one) * (two)) / (one) != (two))
/** Check for additive overflow, failing if it would occur. */
#define GITERR_CHECK_ALLOC_ADD(one, two) \
if (GIT_ALLOC_OVERFLOW_ADD(one, two)) { \
giterr_set_oom(); \
return -1; \
}
/** Check for multiplicative overflow, failing if it would occur. */
#define GITERR_CHECK_ALLOC_MULTIPLY(nelem, elsize) \
if (GIT_ALLOC_OVERFLOW_MULTIPLY(nelem, elsize)) { \
giterr_set_oom(); \
return -1; \
}
/* NOTE: other giterr functions are in the public errors.h header file */
#include "util.h"
......
src/config_file.c
......@@ -903,9 +903,11 @@ static char *reader_readline(struct reader *reader, bool skip_whitespace)
line_len = line_end - line_src;
line = git__malloc(line_len + 1);
if (line == NULL)
if (GIT_ALLOC_OVERFLOW_ADD(line_len, 1) ||
(line = git__malloc(line_len + 1)) == NULL) {
giterr_set_oom();
return NULL;
}
memcpy(line, line_src, line_len);
......@@ -958,6 +960,8 @@ static int parse_section_header_ext(struct reader *reader, const char *line, con
int c, rpos;
char *first_quote, *last_quote;
git_buf buf = GIT_BUF_INIT;
size_t quoted_len, base_name_len = strlen(base_name);
/*
* base_name is what came before the space. We should be at the
* first quotation mark, except for now, line isn't being kept in
......@@ -966,13 +970,17 @@ static int parse_section_header_ext(struct reader *reader, const char *line, con
first_quote = strchr(line, '"');
last_quote = strrchr(line, '"');
quoted_len = last_quote - first_quote;
if (last_quote - first_quote == 0) {
if (quoted_len == 0) {
set_parse_error(reader, 0, "Missing closing quotation mark in section header");
return -1;
}
git_buf_grow(&buf, strlen(base_name) + last_quote - first_quote + 2);
GITERR_CHECK_ALLOC_ADD(base_name_len, quoted_len);
GITERR_CHECK_ALLOC_ADD(base_name_len + quoted_len, 2);
git_buf_grow(&buf, base_name_len + quoted_len + 2);
git_buf_printf(&buf, "%s.", base_name);
rpos = 0;
......@@ -1029,6 +1037,7 @@ static int parse_section_header(struct reader *reader, char **section_out)
int name_length, c, pos;
int result;
char *line;
size_t line_len;
line = reader_readline(reader, true);
if (line == NULL)
......@@ -1042,7 +1051,10 @@ static int parse_section_header(struct reader *reader, char **section_out)
return -1;
}
name = (char *)git__malloc((size_t)(name_end - line) + 1);
line_len = (size_t)(name_end - line);
GITERR_CHECK_ALLOC_ADD(line_len, 1);
name = git__malloc(line_len);
GITERR_CHECK_ALLOC(name);
name_length = 0;
......@@ -1603,11 +1615,16 @@ static char *escape_value(const char *ptr)
/* '\"' -> '"' etc */
static char *fixup_line(const char *ptr, int quote_count)
{
char *str = git__malloc(strlen(ptr) + 1);
char *out = str, *esc;
char *str, *out, *esc;
size_t ptr_len = strlen(ptr);
if (str == NULL)
if (GIT_ALLOC_OVERFLOW_ADD(ptr_len, 1) ||
(str = git__malloc(ptr_len + 1)) == NULL) {
giterr_set_oom();
return NULL;
}
out = str;
while (*ptr != '\0') {
if (*ptr == '"') {
......
src/delta-apply.c
......@@ -74,6 +74,7 @@ int git__delta_apply(
return -1;
}
GITERR_CHECK_ALLOC_ADD(res_sz, 1);
res_dp = git__malloc(res_sz + 1);
GITERR_CHECK_ALLOC(res_dp);
......
src/delta.c
......@@ -119,6 +119,36 @@ struct git_delta_index {
struct index_entry *hash[GIT_FLEX_ARRAY];
};
static int lookup_index_alloc(
void **out, unsigned long *out_len, size_t entries, size_t hash_count)
{
size_t entries_len, hash_len,
index_len = sizeof(struct git_delta_index);
GITERR_CHECK_ALLOC_MULTIPLY(entries, sizeof(struct index_entry));
entries_len = entries * sizeof(struct index_entry);
GITERR_CHECK_ALLOC_ADD(index_len, entries_len);
index_len += entries_len;
GITERR_CHECK_ALLOC_MULTIPLY(hash_count, sizeof(struct index_entry *));
hash_len = hash_count * sizeof(struct index_entry *);
GITERR_CHECK_ALLOC_ADD(index_len, hash_len);
index_len += hash_len;
if (!git__is_ulong(index_len)) {
giterr_set_oom();
return -1;
}
*out = git__malloc(index_len);
GITERR_CHECK_ALLOC(*out);
*out_len = index_len;
return 0;
}
struct git_delta_index *
git_delta_create_index(const void *buf, unsigned long bufsize)
{
......@@ -148,13 +178,9 @@ git_delta_create_index(const void *buf, unsigned long bufsize)
hsize = 1 << i;
hmask = hsize - 1;
/* allocate lookup index */
memsize = sizeof(*index) +
sizeof(*hash) * hsize +
sizeof(*entry) * entries;
mem = git__malloc(memsize);
if (!mem)
if (lookup_index_alloc(&mem, &memsize, entries, hsize) < 0)
return NULL;
index = mem;
mem = index->hash;
hash = mem;
......
src/diff.c
......@@ -1558,8 +1558,10 @@ int git_diff_format_email(
goto on_error;
}
GITERR_CHECK_ALLOC_ADD(offset, 1);
summary = git__calloc(offset + 1, sizeof(char));
GITERR_CHECK_ALLOC(summary);
strncpy(summary, opts->summary, offset);
}
......
src/diff_driver.c
......@@ -158,6 +158,29 @@ static git_diff_driver_registry *git_repository_driver_registry(
return repo->diff_drivers;
}
static int diff_driver_alloc(
git_diff_driver **out, size_t *namelen_out, const char *name)
{
git_diff_driver *driver;
size_t driverlen = sizeof(git_diff_driver),
namelen = strlen(name);
GITERR_CHECK_ALLOC_ADD(driverlen, namelen);
GITERR_CHECK_ALLOC_ADD(driverlen + namelen, 1);
driver = git__calloc(1, driverlen + namelen + 1);
GITERR_CHECK_ALLOC(driver);
memcpy(driver->name, name, namelen);
*out = driver;
if (namelen_out)
*namelen_out = namelen;
return 0;
}
static int git_diff_driver_builtin(
git_diff_driver **out,
git_diff_driver_registry *reg,
......@@ -166,7 +189,7 @@ static int git_diff_driver_builtin(
int error = 0;
git_diff_driver_definition *ddef = NULL;
git_diff_driver *drv = NULL;
size_t namelen, idx;
size_t idx;
for (idx = 0; idx < ARRAY_SIZE(builtin_defs); ++idx) {
if (!strcasecmp(driver_name, builtin_defs[idx].name)) {
......@@ -177,13 +200,10 @@ static int git_diff_driver_builtin(
if (!ddef)
goto done;
namelen = strlen(ddef->name);
drv = git__calloc(1, sizeof(git_diff_driver) + namelen + 1);
GITERR_CHECK_ALLOC(drv);
if ((error = diff_driver_alloc(&drv, NULL, ddef->name)) < 0)
goto done;
drv->type = DIFF_DRIVER_PATTERNLIST;
memcpy(drv->name, ddef->name, namelen);
if (ddef->fns &&
(error = diff_driver_add_patterns(
......@@ -217,9 +237,9 @@ static int git_diff_driver_load(
int error = 0;
git_diff_driver_registry *reg;
git_diff_driver *drv = NULL;
size_t namelen = strlen(driver_name);
size_t namelen;
khiter_t pos;
git_config *cfg;
git_config *cfg = NULL;
git_buf name = GIT_BUF_INIT;
const git_config_entry *ce;
bool found_driver = false;
......@@ -233,10 +253,10 @@ static int git_diff_driver_load(
return 0;
}
drv = git__calloc(1, sizeof(git_diff_driver) + namelen + 1);
GITERR_CHECK_ALLOC(drv);
if ((error = diff_driver_alloc(&drv, &namelen, driver_name)) < 0)
goto done;
drv->type = DIFF_DRIVER_AUTO;
memcpy(drv->name, driver_name, namelen);
/* if you can't read config for repo, just use default driver */
if (git_repository_config_snapshot(&cfg, repo) < 0) {
......
src/diff_patch.c
......@@ -388,8 +388,18 @@ static int diff_patch_with_delta_alloc(
diff_patch_with_delta *pd;
size_t old_len = *old_path ? strlen(*old_path) : 0;
size_t new_len = *new_path ? strlen(*new_path) : 0;
size_t alloc_len = sizeof(*pd);
*out = pd = git__calloc(1, sizeof(*pd) + old_len + new_len + 2);
GITERR_CHECK_ALLOC_ADD(alloc_len, old_len);
alloc_len += old_len;
GITERR_CHECK_ALLOC_ADD(alloc_len, new_len);
alloc_len += new_len;
GITERR_CHECK_ALLOC_ADD(alloc_len, 2);
alloc_len += 2;
*out = pd = git__calloc(1, alloc_len);
GITERR_CHECK_ALLOC(pd);
pd->patch.flags = GIT_DIFF_PATCH_ALLOCATED;
......
src/diff_tform.c
......@@ -831,6 +831,7 @@ int git_diff_find_similar(
if ((opts.flags & GIT_DIFF_FIND_ALL) == 0)
goto cleanup;
GITERR_CHECK_ALLOC_MULTIPLY(num_deltas, 2);
sigcache = git__calloc(num_deltas * 2, sizeof(void *));
GITERR_CHECK_ALLOC(sigcache);
......
src/filebuf.c
......@@ -271,6 +271,7 @@ int git_filebuf_open(git_filebuf *file, const char *path, int flags, mode_t mode
GITERR_CHECK_ALLOC(file->path_original);
/* create the locking path by appending ".lock" to the original */
GITERR_CHECK_ALLOC_ADD(path_len, GIT_FILELOCK_EXTLENGTH);
file->path_lock = git__malloc(path_len + GIT_FILELOCK_EXTLENGTH);
GITERR_CHECK_ALLOC(file->path_lock);
......@@ -437,8 +438,8 @@ int git_filebuf_printf(git_filebuf *file, const char *format, ...)
} while ((size_t)len + 1 <= space_left);
tmp_buffer = git__malloc(len + 1);
if (!tmp_buffer) {
if (GIT_ALLOC_OVERFLOW_ADD(len, 1) ||
!(tmp_buffer = git__malloc(len + 1))) {
file->last_error = BUFERR_MEM;
return -1;
}
......
src/fileops.c
......@@ -127,6 +127,7 @@ int git_futils_readbuffer_fd(git_buf *buf, git_file fd, size_t len)
git_buf_clear(buf);
GITERR_CHECK_ALLOC_ADD(len, 1);
if (git_buf_grow(buf, len + 1) < 0)
return -1;
......@@ -708,7 +709,10 @@ static int cp_link(const char *from, const char *to, size_t link_size)
{
int error = 0;
ssize_t read_len;
char *link_data = git__malloc(link_size + 1);
char *link_data;
GITERR_CHECK_ALLOC_ADD(link_size, 1);
link_data = git__malloc(link_size + 1);
GITERR_CHECK_ALLOC(link_data);
read_len = p_readlink(from, link_data, link_size);
......
src/filter.c
......@@ -228,7 +228,7 @@ int git_filter_register(
const char *name, git_filter *filter, int priority)
{
git_filter_def *fdef;
size_t nattr = 0, nmatch = 0;
size_t nattr = 0, nmatch = 0, alloc_len;
git_buf attrs = GIT_BUF_INIT;
assert(name && filter);
......@@ -245,8 +245,16 @@ int git_filter_register(
if (filter_def_scan_attrs(&attrs, &nattr, &nmatch, filter->attributes) < 0)
return -1;
fdef = git__calloc(
sizeof(git_filter_def) + 2 * nattr * sizeof(char *), 1);
GITERR_CHECK_ALLOC_MULTIPLY(nattr, 2);
alloc_len = nattr * 2;
GITERR_CHECK_ALLOC_MULTIPLY(alloc_len, sizeof(char *));
alloc_len *= sizeof(char *);
GITERR_CHECK_ALLOC_ADD(alloc_len, sizeof(git_filter_def));
alloc_len += sizeof(git_filter_def);
fdef = git__calloc(1, alloc_len);
GITERR_CHECK_ALLOC(fdef);
fdef->filter_name = git__strdup(name);
......@@ -379,6 +387,9 @@ static int filter_list_new(
git_filter_list *fl = NULL;
size_t pathlen = src->path ? strlen(src->path) : 0;
GITERR_CHECK_ALLOC_ADD(sizeof(git_filter_list), pathlen);
GITERR_CHECK_ALLOC_ADD(sizeof(git_filter_list) + pathlen, 1);
fl = git__calloc(1, sizeof(git_filter_list) + pathlen + 1);
GITERR_CHECK_ALLOC(fl);
......
src/index.c
......@@ -779,7 +779,9 @@ static int index_entry_create(
return -1;
}
entry = git__calloc(sizeof(struct entry_internal) + pathlen + 1, 1);
GITERR_CHECK_ALLOC_ADD(sizeof(struct entry_internal), pathlen);
GITERR_CHECK_ALLOC_ADD(sizeof(struct entry_internal) + pathlen, 1);
entry = git__calloc(1, sizeof(struct entry_internal) + pathlen + 1);
GITERR_CHECK_ALLOC(entry);
entry->pathlen = pathlen;
......@@ -826,9 +828,17 @@ static int index_entry_init(
static git_index_reuc_entry *reuc_entry_alloc(const char *path)
{
size_t pathlen = strlen(path);
struct reuc_entry_internal *entry =
git__calloc(sizeof(struct reuc_entry_internal) + pathlen + 1, 1);
size_t pathlen = strlen(path),
structlen = sizeof(struct reuc_entry_internal);
struct reuc_entry_internal *entry;
if (GIT_ALLOC_OVERFLOW_ADD(structlen, pathlen) ||
GIT_ALLOC_OVERFLOW_ADD(structlen + pathlen, 1)) {
giterr_set_oom();
return NULL;
}
entry = git__calloc(1, structlen + pathlen + 1);
if (!entry)
return NULL;
......
src/iterator.c
......@@ -336,7 +336,7 @@ static int tree_iterator__push_frame(tree_iterator *ti)
{
int error = 0;
tree_iterator_frame *head = ti->head, *tf = NULL;
size_t i, n_entries = 0;
size_t i, n_entries = 0, alloclen;
if (head->current >= head->n_entries || !head->entries[head->current]->tree)
return GIT_ITEROVER;
......@@ -344,8 +344,13 @@ static int tree_iterator__push_frame(tree_iterator *ti)
for (i = head->current; i < head->next; ++i)
n_entries += git_tree_entrycount(head->entries[i]->tree);
tf = git__calloc(sizeof(tree_iterator_frame) +
n_entries * sizeof(tree_iterator_entry *), 1);
GITERR_CHECK_ALLOC_MULTIPLY(sizeof(tree_iterator_entry *), n_entries);
alloclen = sizeof(tree_iterator_entry *) * n_entries;
GITERR_CHECK_ALLOC_ADD(alloclen, sizeof(tree_iterator_frame));
alloclen += sizeof(tree_iterator_frame);
tf = git__calloc(1, alloclen);
GITERR_CHECK_ALLOC(tf);
tf->n_entries = n_entries;
......
src/merge.c
......@@ -1169,6 +1169,7 @@ int git_merge_diff_list__find_renames(
goto done;
if (diff_list->conflicts.length <= opts->target_limit) {
GITERR_CHECK_ALLOC_MULTIPLY(diff_list->conflicts.length, 3);
cache_size = diff_list->conflicts.length * 3;
cache = git__calloc(cache_size, sizeof(void *));
GITERR_CHECK_ALLOC(cache);
......@@ -2228,6 +2229,7 @@ static int merge_ancestor_head(
assert(repo && our_head && their_heads);
GITERR_CHECK_ALLOC_ADD(their_heads_len, 1);
oids = git__calloc(their_heads_len + 1, sizeof(git_oid));
GITERR_CHECK_ALLOC(oids);
......
src/notes.c
......@@ -314,7 +314,7 @@ static int note_new(
{
git_note *note = NULL;
note = (git_note *)git__malloc(sizeof(git_note));
note = git__malloc(sizeof(git_note));
GITERR_CHECK_ALLOC(note);
git_oid_cpy(&note->id, note_oid);
......
src/odb.c
......@@ -233,6 +233,7 @@ int git_odb__hashlink(git_oid *out, const char *path)
char *link_data;
ssize_t read_len;
GITERR_CHECK_ALLOC_ADD(size, 1);
link_data = git__malloc((size_t)(size + 1));
GITERR_CHECK_ALLOC(link_data);
......
src/odb_loose.c
......@@ -64,6 +64,8 @@ static int object_file_name(
git_buf *name, const loose_backend *be, const git_oid *id)
{
/* expand length for object root + 40 hex sha1 chars + 2 * '/' + '\0' */
GITERR_CHECK_ALLOC_ADD(be->objects_dirlen, GIT_OID_HEXSZ);
GITERR_CHECK_ALLOC_ADD(be->objects_dirlen + GIT_OID_HEXSZ, 3);
if (git_buf_grow(name, be->objects_dirlen + GIT_OID_HEXSZ + 3) < 0)
return -1;
......@@ -268,7 +270,8 @@ static void *inflate_tail(z_stream *s, void *hb, size_t used, obj_hdr *hdr)
* initial sequence of inflated data from the tail of the
* head buffer, if any.
*/
if ((buf = git__malloc(hdr->size + 1)) == NULL) {
if (GIT_ALLOC_OVERFLOW_ADD(hdr->size, 1) ||
(buf = git__malloc(hdr->size + 1)) == NULL) {
inflateEnd(s);
return NULL;
}
......@@ -321,6 +324,7 @@ static int inflate_packlike_loose_disk_obj(git_rawobj *out, git_buf *obj)
/*
* allocate a buffer and inflate the data into it
*/
GITERR_CHECK_ALLOC_ADD(hdr.size, 1);
buf = git__malloc(hdr.size + 1);
GITERR_CHECK_ALLOC(buf);
......@@ -520,6 +524,8 @@ static int locate_object_short_oid(
int error;
/* prealloc memory for OBJ_DIR/xx/xx..38x..xx */
GITERR_CHECK_ALLOC_ADD(dir_len, GIT_OID_HEXSZ);
GITERR_CHECK_ALLOC_ADD(dir_len + GIT_OID_HEXSZ, 3);
if (git_buf_grow(object_location, dir_len + 3 + GIT_OID_HEXSZ) < 0)
return -1;
......@@ -563,6 +569,8 @@ static int locate_object_short_oid(
return error;
/* Update the location according to the oid obtained */
GITERR_CHECK_ALLOC_ADD(dir_len, GIT_OID_HEXSZ);
GITERR_CHECK_ALLOC_ADD(dir_len + GIT_OID_HEXSZ, 2);
git_buf_truncate(object_location, dir_len);
if (git_buf_grow(object_location, dir_len + GIT_OID_HEXSZ + 2) < 0)
......@@ -928,6 +936,8 @@ int git_odb_backend_loose(
objects_dirlen = strlen(objects_dir);
GITERR_CHECK_ALLOC_ADD(sizeof(loose_backend), objects_dirlen);
GITERR_CHECK_ALLOC_ADD(sizeof(loose_backend) + objects_dirlen, 2);
backend = git__calloc(1, sizeof(loose_backend) + objects_dirlen + 2);
GITERR_CHECK_ALLOC(backend);
......
src/odb_mempack.c
......@@ -47,6 +47,7 @@ static int impl__write(git_odb_backend *_backend, const git_oid *oid, const void
if (rval == 0)
return 0;
GITERR_CHECK_ALLOC_ADD(sizeof(struct memobject), len);
obj = git__malloc(sizeof(struct memobject) + len);
GITERR_CHECK_ALLOC(obj);
......
src/oid.c
......@@ -261,6 +261,7 @@ struct git_oid_shorten {
static int resize_trie(git_oid_shorten *self, size_t new_size)
{
GITERR_CHECK_ALLOC_MULTIPLY(new_size, sizeof(trie_node));
self->nodes = git__realloc(self->nodes, new_size * sizeof(trie_node));
GITERR_CHECK_ALLOC(self->nodes);
......
src/pack-objects.c
......@@ -201,7 +201,11 @@ int git_packbuilder_insert(git_packbuilder *pb, const git_oid *oid,
return 0;
if (pb->nr_objects >= pb->nr_alloc) {
GITERR_CHECK_ALLOC_ADD(pb->nr_alloc, 1024);
GITERR_CHECK_ALLOC_MULTIPLY(pb->nr_alloc + 1024, 3 / 2);
pb->nr_alloc = (pb->nr_alloc + 1024) * 3 / 2;
GITERR_CHECK_ALLOC_MULTIPLY(pb->nr_alloc, sizeof(*po));
pb->object_list = git__realloc(pb->object_list,
pb->nr_alloc * sizeof(*po));
GITERR_CHECK_ALLOC(pb->object_list);
......@@ -499,8 +503,13 @@ static int cb_tag_foreach(const char *name, git_oid *oid, void *data)
static git_pobject **compute_write_order(git_packbuilder *pb)
{
unsigned int i, wo_end, last_untagged;
git_pobject **wo;
git_pobject **wo = git__malloc(sizeof(*wo) * pb->nr_objects);
if (GIT_ALLOC_OVERFLOW_MULTIPLY(pb->nr_objects, sizeof(*wo)) ||
(wo = git__malloc(pb->nr_objects * sizeof(*wo))) == NULL) {
giterr_set_oom();
return NULL;
}
for (i = 0; i < pb->nr_objects; i++) {
git_pobject *po = pb->object_list + i;
......@@ -770,10 +779,13 @@ static int try_delta(git_packbuilder *pb, struct unpacked *trg,
*mem_usage += sz;
}
if (!src->data) {
if (git_odb_read(&obj, pb->odb, &src_object->id) < 0)
size_t obj_sz;
if (git_odb_read(&obj, pb->odb, &src_object->id) < 0 ||
!git__is_ulong(obj_sz = git_odb_object_size(obj)))
return -1;
sz = (unsigned long)git_odb_object_size(obj);
sz = (unsigned long)obj_sz;
src->data = git__malloc(sz);
GITERR_CHECK_ALLOC(src->data);
memcpy(src->data, git_odb_object_data(obj), sz);
......@@ -817,7 +829,9 @@ static int try_delta(git_packbuilder *pb, struct unpacked *trg,
trg_object->delta_data = NULL;
}
if (delta_cacheable(pb, src_size, trg_size, delta_size)) {
GITERR_CHECK_ALLOC_ADD(pb->delta_cache_size, delta_size);
pb->delta_cache_size += delta_size;
git_packbuilder__cache_unlock(pb);
trg_object->delta_data = git__realloc(delta_buf, delta_size);
......@@ -1088,6 +1102,7 @@ static int ll_find_deltas(git_packbuilder *pb, git_pobject **list,
return 0;
}
GITERR_CHECK_ALLOC_MULTIPLY(pb->nr_threads, sizeof(*p));
p = git__malloc(pb->nr_threads * sizeof(*p));
GITERR_CHECK_ALLOC(p);
......@@ -1239,6 +1254,7 @@ static int prepare_pack(git_packbuilder *pb)
if (pb->progress_cb)
pb->progress_cb(GIT_PACKBUILDER_DELTAFICATION, 0, pb->nr_objects, pb->progress_cb_payload);
GITERR_CHECK_ALLOC_MULTIPLY(pb->nr_objects, sizeof(*delta_list));
delta_list = git__malloc(pb->nr_objects * sizeof(*delta_list));
GITERR_CHECK_ALLOC(delta_list);
......
src/pack.c
......@@ -683,8 +683,11 @@ int git_packfile_unpack(
*/
if (cached && stack_size == 1) {
void *data = obj->data;
GITERR_CHECK_ALLOC_ADD(obj->len, 1);
obj->data = git__malloc(obj->len + 1);
GITERR_CHECK_ALLOC(obj->data);
memcpy(obj->data, data, obj->len + 1);
git_atomic_dec(&cached->refcount);
goto cleanup;
......@@ -841,6 +844,7 @@ int packfile_unpack_compressed(
z_stream stream;
unsigned char *buffer, *in;
GITERR_CHECK_ALLOC_ADD(size, 1);
buffer = git__calloc(1, size + 1);
GITERR_CHECK_ALLOC(buffer);
......@@ -1092,6 +1096,9 @@ int git_packfile_alloc(struct git_pack_file **pack_out, const char *path)
if (path_len < strlen(".idx"))
return git_odb__error_notfound("invalid packfile path", NULL);
GITERR_CHECK_ALLOC_ADD(sizeof(*p), path_len);
GITERR_CHECK_ALLOC_ADD(sizeof(*p) + path_len, 2);
p = git__calloc(1, sizeof(*p) + path_len + 2);
GITERR_CHECK_ALLOC(p);
......
src/path.c
......@@ -622,7 +622,9 @@ static bool _check_dir_contents(
size_t sub_size = strlen(sub);
/* leave base valid even if we could not make space for subdir */
if (git_buf_try_grow(dir, dir_size + sub_size + 2, false, false) < 0)
if (GIT_ALLOC_OVERFLOW_ADD(dir_size, sub_size) ||
GIT_ALLOC_OVERFLOW_ADD(dir_size + sub_size, 2) ||
git_buf_try_grow(dir, dir_size + sub_size + 2, false, false) < 0)
return false;
/* save excursion */
......@@ -822,6 +824,9 @@ int git_path_make_relative(git_buf *path, const char *parent)
for (; (q = strchr(q, '/')) && *(q + 1); q++)
depth++;
GITERR_CHECK_ALLOC_MULTIPLY(depth, 3);
GITERR_CHECK_ALLOC_ADD(depth * 3, plen);
GITERR_CHECK_ALLOC_ADD(depth * 3, 1);
newlen = (depth * 3) + plen;
/* save the offset as we might realllocate the pointer */
......@@ -881,6 +886,7 @@ int git_path_iconv(git_path_iconv_t *ic, char **in, size_t *inlen)
git_buf_clear(&ic->buf);
while (1) {
GITERR_CHECK_ALLOC_ADD(wantlen, 1);
if (git_buf_grow(&ic->buf, wantlen + 1) < 0)
return -1;
......@@ -1057,6 +1063,45 @@ int git_path_direach(
return error;
}
static int entry_path_alloc(
char **out,
const char *path,
size_t path_len,
const char *de_path,
size_t de_len,
size_t alloc_extra)
{
int need_slash = (path_len > 0 && path[path_len-1] != '/') ? 1 : 0;
size_t alloc_size = path_len;
char *entry_path;
GITERR_CHECK_ALLOC_ADD(alloc_size, de_len);
alloc_size += de_len;
GITERR_CHECK_ALLOC_ADD(alloc_size, need_slash);
alloc_size += need_slash;
GITERR_CHECK_ALLOC_ADD(alloc_size, 1);
alloc_size++;
GITERR_CHECK_ALLOC_ADD(alloc_size, alloc_extra);
alloc_size += alloc_extra;
entry_path = git__calloc(1, alloc_size);
GITERR_CHECK_ALLOC(entry_path);
if (path_len)
memcpy(entry_path, path, path_len);
if (need_slash)
entry_path[path_len] = '/';
memcpy(&entry_path[path_len + need_slash], de_path, de_len);
*out = entry_path;
return 0;
}
int git_path_dirload(
const char *path,
size_t prefix_len,
......@@ -1064,7 +1109,7 @@ int git_path_dirload(
unsigned int flags,
git_vector *contents)
{
int error, need_slash;
int error;
DIR *dir;
size_t path_len;
path_dirent_data de_data;
......@@ -1096,11 +1141,10 @@ int git_path_dirload(
path += prefix_len;
path_len -= prefix_len;
need_slash = (path_len > 0 && path[path_len-1] != '/') ? 1 : 0;
while ((error = p_readdir_r(dir, de_buf, &de)) == 0 && de != NULL) {
char *entry_path, *de_path = de->d_name;
size_t alloc_size, de_len = strlen(de_path);
size_t de_len = strlen(de_path);
if (git_path_is_dot_or_dotdot(de_path))
continue;
......@@ -1110,17 +1154,9 @@ int git_path_dirload(
break;
#endif
alloc_size = path_len + need_slash + de_len + 1 + alloc_extra;
if ((entry_path = git__calloc(alloc_size, 1)) == NULL) {
error = -1;
if ((error = entry_path_alloc(&entry_path,
path, path_len, de_path, de_len, alloc_extra)) < 0)
break;
}
if (path_len)
memcpy(entry_path, path, path_len);
if (need_slash)
entry_path[path_len] = '/';
memcpy(&entry_path[path_len + need_slash], de_path, de_len);
if ((error = git_vector_insert(contents, entry_path)) < 0) {
git__free(entry_path);
......
src/pool.c
......@@ -116,9 +116,11 @@ static void *pool_alloc_page(git_pool *pool, uint32_t size)
pool->has_large_page_alloc = 1;
}
page = git__calloc(1, alloc_size + sizeof(git_pool_page));
if (!page)
if (GIT_ALLOC_OVERFLOW_ADD(alloc_size, sizeof(git_pool_page)) ||
!(page = git__calloc(1, alloc_size + sizeof(git_pool_page)))) {
giterr_set_oom();
return NULL;
}
page->size = alloc_size;
page->avail = alloc_size - size;
......
src/refs.c
......@@ -37,10 +37,14 @@ enum {
static git_reference *alloc_ref(const char *name)
{
git_reference *ref;
size_t namelen = strlen(name);
size_t namelen = strlen(name), reflen = sizeof(git_reference);
if ((ref = git__calloc(1, sizeof(git_reference) + namelen + 1)) == NULL)
if (GIT_ALLOC_OVERFLOW_ADD(reflen, namelen) ||
GIT_ALLOC_OVERFLOW_ADD(reflen + namelen, 1) ||
(ref = git__calloc(1, reflen + namelen + 1)) == NULL) {
giterr_set_oom();
return NULL;
}
memcpy(ref->name, name, namelen + 1);
......@@ -94,10 +98,14 @@ git_reference *git_reference__set_name(
git_reference *ref, const char *name)
{
size_t namelen = strlen(name);
git_reference *rewrite =
git__realloc(ref, sizeof(git_reference) + namelen + 1);
if (rewrite != NULL)
size_t reflen = sizeof(git_reference);
git_reference *rewrite = NULL;
if (!GIT_ALLOC_OVERFLOW_ADD(reflen, namelen) &&
!GIT_ALLOC_OVERFLOW_ADD(reflen + namelen, 1) &&
(rewrite = git__realloc(ref, reflen + namelen + 1)) != NULL)
memcpy(rewrite->name, name, namelen + 1);
return rewrite;
}
......
src/remote.c
......@@ -383,10 +383,9 @@ int git_remote_lookup(git_remote **out, git_repository *repo, const char *name)
if ((error = git_repository_config_snapshot(&config, repo)) < 0)
return error;
remote = git__malloc(sizeof(git_remote));
remote = git__calloc(1, sizeof(git_remote));
GITERR_CHECK_ALLOC(remote);
memset(remote, 0x0, sizeof(git_remote));
remote->update_fetchhead = 1;
remote->name = git__strdup(name);
GITERR_CHECK_ALLOC(remote->name);
......
src/revwalk.c
......@@ -503,13 +503,9 @@ static int prepare_walk(git_revwalk *walk)
int git_revwalk_new(git_revwalk **revwalk_out, git_repository *repo)
{
git_revwalk *walk;
walk = git__malloc(sizeof(git_revwalk));
git_revwalk *walk = git__calloc(1, sizeof(git_revwalk));
GITERR_CHECK_ALLOC(walk);
memset(walk, 0x0, sizeof(git_revwalk));
walk->commits = git_oidmap_alloc();
GITERR_CHECK_ALLOC(walk->commits);
......
src/sortedcache.c
......@@ -15,7 +15,9 @@ int git_sortedcache_new(
pathlen = path ? strlen(path) : 0;
sc = git__calloc(sizeof(git_sortedcache) + pathlen + 1, 1);
GITERR_CHECK_ALLOC_ADD(sizeof(git_sortedcache), pathlen);
GITERR_CHECK_ALLOC_ADD(sizeof(git_sortedcache) + pathlen, 1);
sc = git__calloc(1, sizeof(git_sortedcache) + pathlen + 1);
GITERR_CHECK_ALLOC(sc);
if (git_pool_init(&sc->pool, 1, 0) < 0 ||
......
src/tag.c
......@@ -117,6 +117,7 @@ static int tag_parse(git_tag *tag, const char *buffer, const char *buffer_end)
text_len = search - buffer;
GITERR_CHECK_ALLOC_ADD(text_len, 1);
tag->tag_name = git__malloc(text_len + 1);
GITERR_CHECK_ALLOC(tag->tag_name);
......@@ -141,6 +142,7 @@ static int tag_parse(git_tag *tag, const char *buffer, const char *buffer_end)
text_len = buffer_end - ++buffer;
GITERR_CHECK_ALLOC_ADD(text_len, 1);
tag->message = git__malloc(text_len + 1);
GITERR_CHECK_ALLOC(tag->message);
......
src/transports/cred.c
......@@ -311,6 +311,9 @@ int git_cred_username_new(git_cred **cred, const char *username)
assert(cred);
len = strlen(username);
GITERR_CHECK_ALLOC_ADD(sizeof(git_cred_username), len);
GITERR_CHECK_ALLOC_ADD(sizeof(git_cred_username) + len, 1);
c = git__malloc(sizeof(git_cred_username) + len + 1);
GITERR_CHECK_ALLOC(c);
......
src/transports/git.c
......@@ -154,7 +154,7 @@ static int git_proto_stream_alloc(
if (!stream)
return -1;
s = git__calloc(sizeof(git_proto_stream), 1);
s = git__calloc(1, sizeof(git_proto_stream));
GITERR_CHECK_ALLOC(s);
s->parent.subtransport = &t->parent;
......@@ -347,7 +347,7 @@ int git_smart_subtransport_git(git_smart_subtransport **out, git_transport *owne
if (!out)
return -1;
t = git__calloc(sizeof(git_subtransport), 1);
t = git__calloc(1, sizeof(git_subtransport));
GITERR_CHECK_ALLOC(t);
t->owner = owner;
......
src/transports/local.c
......@@ -420,7 +420,7 @@ static int local_push(
const git_error *last;
char *ref = spec->refspec.dst;
status = git__calloc(sizeof(push_status), 1);
status = git__calloc(1, sizeof(push_status));
if (!status)
goto on_error;
......
src/transports/smart.c
......@@ -380,7 +380,7 @@ int git_transport_smart(git_transport **out, git_remote *owner, void *param)
if (!param)
return -1;
t = git__calloc(sizeof(transport_smart), 1);
t = git__calloc(1, sizeof(transport_smart));
GITERR_CHECK_ALLOC(t);
t->parent.version = GIT_TRANSPORT_VERSION;
......
src/transports/smart_pkt.c
......@@ -103,6 +103,8 @@ static int comment_pkt(git_pkt **out, const char *line, size_t len)
{
git_pkt_comment *pkt;
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_comment), len);
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_comment) + len, 1);
pkt = git__malloc(sizeof(git_pkt_comment) + len + 1);
GITERR_CHECK_ALLOC(pkt);
......@@ -122,6 +124,9 @@ static int err_pkt(git_pkt **out, const char *line, size_t len)
/* Remove "ERR " from the line */
line += 4;
len -= 4;
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_progress), len);
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_progress) + len, 1);
pkt = git__malloc(sizeof(git_pkt_err) + len + 1);
GITERR_CHECK_ALLOC(pkt);
......@@ -141,6 +146,8 @@ static int data_pkt(git_pkt **out, const char *line, size_t len)
line++;
len--;
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_progress), len);
pkt = git__malloc(sizeof(git_pkt_data) + len);
GITERR_CHECK_ALLOC(pkt);
......@@ -159,6 +166,8 @@ static int sideband_progress_pkt(git_pkt **out, const char *line, size_t len)
line++;
len--;
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_progress), len);
pkt = git__malloc(sizeof(git_pkt_progress) + len);
GITERR_CHECK_ALLOC(pkt);
......@@ -177,6 +186,9 @@ static int sideband_error_pkt(git_pkt **out, const char *line, size_t len)
line++;
len--;
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_err), len);
GITERR_CHECK_ALLOC_ADD(sizeof(git_pkt_err) + len, 1);
pkt = git__malloc(sizeof(git_pkt_err) + len + 1);
GITERR_CHECK_ALLOC(pkt);
......@@ -220,6 +232,7 @@ static int ref_pkt(git_pkt **out, const char *line, size_t len)
if (line[len - 1] == '\n')
--len;
GITERR_CHECK_ALLOC_ADD(len, 1);
pkt->head.name = git__malloc(len + 1);
GITERR_CHECK_ALLOC(pkt->head.name);
......@@ -249,9 +262,13 @@ static int ok_pkt(git_pkt **out, const char *line, size_t len)
pkt->type = GIT_PKT_OK;
line += 3; /* skip "ok " */
ptr = strchr(line, '\n');
if (!(ptr = strchr(line, '\n'))) {
giterr_set(GITERR_NET, "Invalid packet line");
return -1;
}
len = ptr - line;
GITERR_CHECK_ALLOC_ADD(len, 1);
pkt->ref = git__malloc(len + 1);
GITERR_CHECK_ALLOC(pkt->ref);
......@@ -273,9 +290,13 @@ static int ng_pkt(git_pkt **out, const char *line, size_t len)
pkt->type = GIT_PKT_NG;
line += 3; /* skip "ng " */
ptr = strchr(line, ' ');
if (!(ptr = strchr(line, ' '))) {
giterr_set(GITERR_NET, "Invalid packet line");
return -1;
}
len = ptr - line;
GITERR_CHECK_ALLOC_ADD(len, 1);
pkt->ref = git__malloc(len + 1);
GITERR_CHECK_ALLOC(pkt->ref);
......@@ -283,9 +304,13 @@ static int ng_pkt(git_pkt **out, const char *line, size_t len)
pkt->ref[len] = '\0';
line = ptr + 1;
ptr = strchr(line, '\n');
if (!(ptr = strchr(line, '\n'))) {
giterr_set(GITERR_NET, "Invalid packet line");
return -1;
}
len = ptr - line;
GITERR_CHECK_ALLOC_ADD(len, 1);
pkt->msg = git__malloc(len + 1);
GITERR_CHECK_ALLOC(pkt->msg);
......
src/transports/smart_protocol.c
......@@ -685,7 +685,7 @@ static int add_push_report_pkt(git_push *push, git_pkt *pkt)
switch (pkt->type) {
case GIT_PKT_OK:
status = git__calloc(sizeof(push_status), 1);
status = git__calloc(1, sizeof(push_status));
GITERR_CHECK_ALLOC(status);
status->msg = NULL;
status->ref = git__strdup(((git_pkt_ok *)pkt)->ref);
......@@ -696,7 +696,7 @@ static int add_push_report_pkt(git_push *push, git_pkt *pkt)
}
break;
case GIT_PKT_NG:
status = git__calloc(sizeof(push_status), 1);
status = git__calloc(1, sizeof(push_status));
GITERR_CHECK_ALLOC(status);
status->ref = git__strdup(((git_pkt_ng *)pkt)->ref);
status->msg = git__strdup(((git_pkt_ng *)pkt)->msg);
......
src/transports/winhttp.c
......@@ -1178,7 +1178,7 @@ static int winhttp_stream_alloc(winhttp_subtransport *t, winhttp_stream **stream
if (!stream)
return -1;
s = git__calloc(sizeof(winhttp_stream), 1);
s = git__calloc(1, sizeof(winhttp_stream));
GITERR_CHECK_ALLOC(s);
s->parent.subtransport = &t->parent;
......@@ -1329,7 +1329,7 @@ int git_smart_subtransport_http(git_smart_subtransport **out, git_transport *own
if (!out)
return -1;
t = git__calloc(sizeof(winhttp_subtransport), 1);
t = git__calloc(1, sizeof(winhttp_subtransport));
GITERR_CHECK_ALLOC(t);
t->owner = (transport_smart *)owner;
......
src/tree.c
......@@ -84,11 +84,15 @@ int git_tree_entry_icmp(const git_tree_entry *e1, const git_tree_entry *e2)
static git_tree_entry *alloc_entry(const char *filename)
{
git_tree_entry *entry = NULL;
size_t filename_len = strlen(filename);
size_t filename_len = strlen(filename),
tree_len = sizeof(git_tree_entry);
entry = git__malloc(sizeof(git_tree_entry) + filename_len + 1);
if (!entry)
if (GIT_ALLOC_OVERFLOW_ADD(tree_len, filename_len) ||
GIT_ALLOC_OVERFLOW_ADD(tree_len + filename_len, 1) ||
!(entry = git__malloc(tree_len + filename_len + 1))) {
giterr_set_oom();
return NULL;
}
memset(entry, 0x0, sizeof(git_tree_entry));
memcpy(entry->filename, filename, filename_len);
......@@ -205,12 +209,16 @@ void git_tree_entry_free(git_tree_entry *entry)
int git_tree_entry_dup(git_tree_entry **dest, const git_tree_entry *source)
{
size_t total_size;
size_t total_size = sizeof(git_tree_entry);
git_tree_entry *copy;
assert(source);
total_size = sizeof(git_tree_entry) + source->filename_len + 1;
GITERR_CHECK_ALLOC_ADD(total_size, source->filename_len);
total_size += source->filename_len;
GITERR_CHECK_ALLOC_ADD(total_size, 1);
total_size++;
copy = git__malloc(total_size);
GITERR_CHECK_ALLOC(copy);
......
src/tsort.c
......@@ -184,7 +184,10 @@ static int check_invariant(struct tsort_run *stack, ssize_t stack_curr)
static int resize(struct tsort_store *store, size_t new_size)
{
if (store->alloc < new_size) {
void **tempstore = git__realloc(store->storage, new_size * sizeof(void *));
void **tempstore;
GITERR_CHECK_ALLOC_MULTIPLY(new_size, sizeof(void *));
tempstore = git__realloc(store->storage, new_size * sizeof(void *));
/**
* Do not propagate on OOM; this will abort the sort and
......
src/util.h
......@@ -64,7 +64,12 @@ GIT_INLINE(char *) git__strndup(const char *str, size_t n)
length = p_strnlen(str, n);
ptr = (char*)git__malloc(length + 1);
if (GIT_ALLOC_OVERFLOW_ADD(length, 1)) {
giterr_set_oom();
return NULL;
}
ptr = git__malloc(length + 1);
if (!ptr)
return NULL;
......@@ -80,7 +85,13 @@ GIT_INLINE(char *) git__strndup(const char *str, size_t n)
/* NOTE: This doesn't do null or '\0' checking. Watch those boundaries! */
GIT_INLINE(char *) git__substrdup(const char *start, size_t n)
{
char *ptr = (char*)git__malloc(n+1);
char *ptr;
if (GIT_ALLOC_OVERFLOW_ADD(n, 1) || !(ptr = git__malloc(n+1))) {
giterr_set_oom();
return NULL;
}
memcpy(ptr, start, n);
ptr[n] = '\0';
return ptr;
......
src/vector.c
......@@ -29,12 +29,12 @@ GIT_INLINE(size_t) compute_new_size(git_vector *v)
GIT_INLINE(int) resize_vector(git_vector *v, size_t new_size)
{
size_t new_bytes = new_size * sizeof(void *);
size_t new_bytes;
void *new_contents;
/* Check for overflow */
if (new_bytes / sizeof(void *) != new_size)
GITERR_CHECK_ALLOC(NULL);
GITERR_CHECK_ALLOC_MULTIPLY(new_size, sizeof(void *));
new_bytes = new_size * sizeof(void *);
new_contents = git__realloc(v->contents, new_bytes);
GITERR_CHECK_ALLOC(new_contents);
......@@ -51,6 +51,7 @@ int git_vector_dup(git_vector *v, const git_vector *src, git_vector_cmp cmp)
assert(v && src);
GITERR_CHECK_ALLOC_MULTIPLY(src->length, sizeof(void *));
bytes = src->length * sizeof(void *);
v->_alloc_size = src->length;
......
src/win32/dir.c
......@@ -18,9 +18,13 @@ git__DIR *git__opendir(const char *dir)
dirlen = strlen(dir);
new = git__calloc(sizeof(*new) + dirlen + 1, 1);
if (!new)
if (GIT_ALLOC_OVERFLOW_ADD(sizeof(*new), dirlen) ||
GIT_ALLOC_OVERFLOW_ADD(sizeof(*new) + dirlen, 1) ||
!(new = git__calloc(1, sizeof(*new) + dirlen + 1))) {
giterr_set_oom();
return NULL;
}
memcpy(new->dir, dir, dirlen);
new->h = FindFirstFileW(filter_w, &new->f);
......
src/win32/utf-conv.c
......@@ -99,9 +99,8 @@ int git__utf8_to_16_alloc(wchar_t **dest, const char *src)
return -1;
}
*dest = git__malloc(utf16_size * sizeof(wchar_t));
if (!*dest) {
if (GIT_ALLOC_OVERFLOW_MULTIPLY(utf16_size, sizeof(wchar_t)) ||
!(*dest = git__malloc(utf16_size * sizeof(wchar_t)))) {
errno = ENOMEM;
return -1;
}
......
src/zstream.c
......@@ -134,6 +134,7 @@ int git_zstream_deflatebuf(git_buf *out, const void *in, size_t in_len)
while (!git_zstream_done(&zs)) {
size_t step = git_zstream_suggest_output_len(&zs), written;
GITERR_CHECK_ALLOC_ADD(out->size, step);
if ((error = git_buf_grow(out, out->size + step)) < 0)
goto done;
......
tests/core/errors.c
......@@ -109,3 +109,43 @@ void test_core_errors__restore(void)
cl_assert_equal_i(42, giterr_last()->klass);
cl_assert_equal_s("Foo: bar", giterr_last()->message);
}
static int test_arraysize_multiply(size_t nelem, size_t size)
{
GITERR_CHECK_ALLOC_MULTIPLY(nelem, size);
return 0;
}
void test_core_errors__integer_overflow_alloc_multiply(void)
{
cl_git_pass(test_arraysize_multiply(10, 10));
cl_git_pass(test_arraysize_multiply(1000, 1000));
cl_git_pass(test_arraysize_multiply(SIZE_MAX/sizeof(void *), sizeof(void *)));
cl_git_pass(test_arraysize_multiply(0, 10));
cl_git_pass(test_arraysize_multiply(10, 0));
cl_git_fail(test_arraysize_multiply(SIZE_MAX-1, sizeof(void *)));
cl_git_fail(test_arraysize_multiply((SIZE_MAX/sizeof(void *))+1, sizeof(void *)));
cl_assert_equal_i(GITERR_NOMEMORY, giterr_last()->klass);
cl_assert_equal_s("Out of memory", giterr_last()->message);
}
static int test_arraysize_add(size_t one, size_t two)
{
GITERR_CHECK_ALLOC_ADD(one, two);
return 0;
}
void test_core_errors__integer_overflow_alloc_add(void)
{
cl_git_pass(test_arraysize_add(10, 10));
cl_git_pass(test_arraysize_add(1000, 1000));
cl_git_pass(test_arraysize_add(SIZE_MAX-10, 10));
cl_git_fail(test_arraysize_multiply(SIZE_MAX-1, 2));
cl_git_fail(test_arraysize_multiply(SIZE_MAX, SIZE_MAX));
cl_assert_equal_i(GITERR_NOMEMORY, giterr_last()->klass);
cl_assert_equal_s("Out of memory", giterr_last()->message);
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment