mirror/zx2c4.cgit
1
0
Fork 0
mirror of https://git.zx2c4.com/cgit synced 2025-07-24 04:35:46 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix out-of-bounds memory accesses with virtual_root=""

Browse source 
The CGit configuration variable virtual_root is normalized so that it
does not have a trailing '/' character, but it is allowed to be empty
(the empty string and NULL have different meanings here) and there is
code that is insufficiently cautious when checking if it ends in a '/':

	if (virtual_root[strlen(virtual_root) - 1] != '/')

Clearly this check is redundant, but rather than simply removing it we
get a slight efficiency improvement by switching the normalization so
that the virtual_root variable always ends in '/'.  Do this with a new
"ensure_end" helper.

Signed-off-by: John Keeping <john@keeping.me.uk>
This commit is contained in:
John Keeping 2013-04-01 19:03:34 +01:00 • committed by Jason A. Donenfeld
parent 4b4a62d507
commit b1f17f168b
4 changed files with 25 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

11
cgit.c
View file

@ -155,9 +155,7 @@ static void config_cb(const char *name, const char *value)
else if (!strcmp(name, "strict-export"))
ctx.cfg.strict_export = xstrdup(value);
else if (!strcmp(name, "virtual-root")) {
ctx.cfg.virtual_root = trim_end(value, '/');
if (!ctx.cfg.virtual_root && (!strcmp(value, "/")))
ctx.cfg.virtual_root = "";
ctx.cfg.virtual_root = ensure_end(value, '/');
} else if (!strcmp(name, "nocache"))
ctx.cfg.nocache = atoi(value);
else if (!strcmp(name, "noplainemail"))
@ -833,11 +831,8 @@ int main(int argc, const char **argv)
* that virtual-root equals SCRIPT_NAME, minus any possibly
* trailing slashes.
*/
if (!ctx.cfg.virtual_root && ctx.cfg.script_name) {
ctx.cfg.virtual_root = trim_end(ctx.cfg.script_name, '/');
if (!ctx.cfg.virtual_root)
ctx.cfg.virtual_root = "";
}
if (!ctx.cfg.virtual_root && ctx.cfg.script_name)
ctx.cfg.virtual_root = ensure_end(ctx.cfg.script_name, '/');
/* If no url parameter is specified on the querystring, lets
* use PATH_INFO as url. This allows cgit to work with virtual