Skip to content

Commit

Permalink
cache-tree: replace a sscanf() by two strtol() calls
Browse files Browse the repository at this point in the history
On one of my systems, sscanf() first calls strlen() on the buffer. But
this buffer is not terminated by NUL. So git crashed.

strtol() does not share that problem, as it stops reading after the
first non-digit.

[jc: original patch was wrong and did not read the cache-tree
 structure correctly; this has been fixed up and tested minimally
 with fsck-objects. ]

Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
  • Loading branch information
Johannes Schindelin authored and Junio C Hamano committed May 2, 2006
1 parent 7bc70a5 commit 0111ea3
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion cache-tree.c
Original file line number Diff line number Diff line change
Expand Up @@ -440,6 +440,8 @@ static struct cache_tree *read_one(const char **buffer, unsigned long *size_p)
{
const char *buf = *buffer;
unsigned long size = *size_p;
const char *cp;
char *ep;
struct cache_tree *it;
int i, subtree_nr;

Expand All @@ -453,7 +455,14 @@ static struct cache_tree *read_one(const char **buffer, unsigned long *size_p)
goto free_return;
buf++; size--;
it = cache_tree();
if (sscanf(buf, "%d %d\n", &it->entry_count, &subtree_nr) != 2)

cp = buf;
it->entry_count = strtol(cp, &ep, 10);
if (cp == ep)
goto free_return;
cp = ep;
subtree_nr = strtol(cp, &ep, 10);
if (cp == ep)
goto free_return;
while (size && *buf && *buf != '\n') {
size--;
Expand Down

0 comments on commit 0111ea3

Please sign in to comment.