Commit b16692fa by Kirill A. Shutemov Committed by Vicent Marti

index: fix potential overflow

mode field of git_index_entry_unmerged is array of unsigned ints. It's
unsafe to cast pointer to an element of the array to long int *. It may
cause overflow in git_strtol32().

Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
parent ae9f771c
......@@ -657,10 +657,14 @@ static int read_unmerged(git_index *index, const char *buffer, size_t size)
buffer += len;
for (i = 0; i < 3; i++) {
if (git__strtol32((long int *) &lost->mode[i], buffer, &endptr, 8) < GIT_SUCCESS ||
!endptr || endptr == buffer || *endptr)
long tmp;
if (git__strtol32(&tmp, buffer, &endptr, 8) < GIT_SUCCESS ||
!endptr || endptr == buffer || *endptr || tmp > UINT_MAX)
return GIT_ERROR;
lost->mode[i] = tmp;
len = (endptr + 1) - buffer;
if (size <= len)
return git__throw(GIT_ERROR, "Failed to read unmerged entries");
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment