From b1f17f168b91d709c0c0e62608de301a36f06da9 Mon Sep 17 00:00:00 2001 From: John Keeping Date: Mon, 1 Apr 2013 19:03:34 +0100 Subject: Fix out-of-bounds memory accesses with virtual_root="" The CGit configuration variable virtual_root is normalized so that it does not have a trailing '/' character, but it is allowed to be empty (the empty string and NULL have different meanings here) and there is code that is insufficiently cautious when checking if it ends in a '/': if (virtual_root[strlen(virtual_root) - 1] != '/') Clearly this check is redundant, but rather than simply removing it we get a slight efficiency improvement by switching the normalization so that the virtual_root variable always ends in '/'. Do this with a new "ensure_end" helper. Signed-off-by: John Keeping --- cgit.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'cgit.h') diff --git a/cgit.h b/cgit.h index 081f669..fc3fc6f 100644 --- a/cgit.h +++ b/cgit.h @@ -190,7 +190,7 @@ struct cgit_config { char *script_name; char *section; char *repository_sort; - char *virtual_root; + char *virtual_root; /* Always ends with '/'. */ char *strict_export; int cache_size; int cache_dynamic_ttl; @@ -300,6 +300,7 @@ extern int chk_positive(int result, char *msg); extern int chk_non_negative(int result, char *msg); extern char *trim_end(const char *str, char c); +extern char *ensure_end(const char *str, char c); extern char *strlpart(char *txt, int maxlen); extern char *strrpart(char *txt, int maxlen); -- cgit v1.2.1