• Michael Haggerty's avatar
    lockfile: fix buffer overflow in path handling · 2fbd4f92
    Michael Haggerty authored
    The path of the file to be locked is held in lock_file::filename,
    which is a fixed-length buffer of length PATH_MAX.  This buffer is
    also (temporarily) used to hold the path of the lock file, which is
    the path of the file being locked plus ".lock".  Because of this, the
    path of the file being locked must be less than (PATH_MAX - 5)
    characters long (5 chars are needed for ".lock" and one character for
    the NUL terminator).
    
    On entry into lock_file(), the path length was only verified to be
    less than PATH_MAX characters, not less than (PATH_MAX - 5)
    characters.
    
    When and if resolve_symlink() is called, then that function is
    correctly told to treat the buffer as (PATH_MAX - 5) characters long.
    This part is correct.  However:
    
    * If LOCK_NODEREF was specified, then resolve_symlink() is never
      called.
    
    * If resolve_symlink() is called but the path is not a symlink, then
      the length check is never applied.
    
    So it is possible for a path with length (PATH_MAX - 5 <= len <
    PATH_MAX) to make it through the checks.  When ".lock" is strcat()ted
    to such a path, the lock_file::filename buffer is overflowed.
    
    Fix the problem by adding a check when entering lock_file() that the
    original path is less than (PATH_MAX - 5) characters.
    
    [jc: with independent development by Peff]
    Signed-off-by: default avatarMichael Haggerty <[email protected]>
    Signed-off-by: default avatarJunio C Hamano <[email protected]>
    2fbd4f92
lockfile.c 6.28 KB