diff options
| author | John Keeping <john@keeping.me.uk> | 2013-04-01 19:03:34 +0100 |
|---|---|---|
| committer | Jason A. Donenfeld <Jason@zx2c4.com> | 2013-04-08 15:59:46 +0200 |
| commit | b1f17f168b91d709c0c0e62608de301a36f06da9 (patch) | |
| tree | 9aff1fe903087cb5016ab2afdb32a7ca1cc139b2 /ui-shared.c | |
| parent | 4b4a62d507adc61e20e75e2748301ef307a6c95f (diff) | |
| download | cgit-b1f17f168b91d709c0c0e62608de301a36f06da9.tar.gz cgit-b1f17f168b91d709c0c0e62608de301a36f06da9.tar.bz2 | |
Fix out-of-bounds memory accesses with virtual_root=""
The CGit configuration variable virtual_root is normalized so that it
does not have a trailing '/' character, but it is allowed to be empty
(the empty string and NULL have different meanings here) and there is
code that is insufficiently cautious when checking if it ends in a '/':
if (virtual_root[strlen(virtual_root) - 1] != '/')
Clearly this check is redundant, but rather than simply removing it we
get a slight efficiency improvement by switching the normalization so
that the virtual_root variable always ends in '/'. Do this with a new
"ensure_end" helper.
Signed-off-by: John Keeping <john@keeping.me.uk>
Diffstat (limited to 'ui-shared.c')
| -rw-r--r-- | ui-shared.c | 14 |
1 files changed, 5 insertions, 9 deletions
diff --git a/ui-shared.c b/ui-shared.c index 945d560..c1f3c20 100644 --- a/ui-shared.c +++ b/ui-shared.c @@ -57,7 +57,7 @@ const char *cgit_hosturl() const char *cgit_rooturl() { if (ctx.cfg.virtual_root) - return fmt("%s/", ctx.cfg.virtual_root); + return ctx.cfg.virtual_root; else return ctx.cfg.script_name; } @@ -65,7 +65,7 @@ const char *cgit_rooturl() char *cgit_repourl(const char *reponame) { if (ctx.cfg.virtual_root) { - return fmt("%s/%s/", ctx.cfg.virtual_root, reponame); + return fmt("%s%s/", ctx.cfg.virtual_root, reponame); } else { return fmt("?r=%s", reponame); } @@ -78,7 +78,7 @@ char *cgit_fileurl(const char *reponame, const char *pagename, char *delim; if (ctx.cfg.virtual_root) { - tmp = fmt("%s/%s/%s/%s", ctx.cfg.virtual_root, reponame, + tmp = fmt("%s%s/%s/%s", ctx.cfg.virtual_root, reponame, pagename, (filename ? filename:"")); delim = "?"; } else { @@ -126,11 +126,9 @@ static void site_url(const char *page, const char *search, const char *sort, int { char *delim = "?"; - if (ctx.cfg.virtual_root) { + if (ctx.cfg.virtual_root) html_attr(ctx.cfg.virtual_root); - if (ctx.cfg.virtual_root[strlen(ctx.cfg.virtual_root) - 1] != '/') - html("/"); - } else + else html(ctx.cfg.script_name); if (page) { @@ -201,8 +199,6 @@ static char *repolink(const char *title, const char *class, const char *page, html(" href='"); if (ctx.cfg.virtual_root) { html_url_path(ctx.cfg.virtual_root); - if (ctx.cfg.virtual_root[strlen(ctx.cfg.virtual_root) - 1] != '/') - html("/"); html_url_path(ctx.repo->url); if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/') html("/"); |