diff options
author | Patrick Steinhardt <ps@pks.im> | 2022-12-01 17:46:49 +0300 |
---|---|---|
committer | Junio C Hamano <gitster@pobox.com> | 2022-12-09 08:26:21 +0300 |
commit | 48050c42c73c28b0c001d63d11dffac7e116847b (patch) | |
tree | fbea2ce85a3b749345fd987b13277e8f7ab26e00 /git-compat-util.h | |
parent | 1de69c0cdd388b0a5b7bdde0bfa0bda514a354b0 (diff) |
pretty: fix integer overflow in wrapping format
The `%w(width,indent1,indent2)` formatting directive can be used to
rewrap text to a specific width and is designed after git-shortlog(1)'s
`-w` parameter. While the three parameters are all stored as `size_t`
internally, `strbuf_add_wrapped_text()` accepts integers as input. As a
result, the casted integers may overflow. As these now-negative integers
are later on passed to `strbuf_addchars()`, we will ultimately run into
implementation-defined behaviour due to casting a negative number back
to `size_t` again. On my platform, this results in trying to allocate
9000 petabyte of memory.
Fix this overflow by using `cast_size_t_to_int()` so that we reject
inputs that cannot be represented as an integer.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'git-compat-util.h')
-rw-r--r-- | git-compat-util.h | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/git-compat-util.h b/git-compat-util.h index f505f817d5..0ac1b7f560 100644 --- a/git-compat-util.h +++ b/git-compat-util.h @@ -918,6 +918,14 @@ static inline size_t st_sub(size_t a, size_t b) return a - b; } +static inline int cast_size_t_to_int(size_t a) +{ + if (a > INT_MAX) + die("number too large to represent as int on this platform: %"PRIuMAX, + (uintmax_t)a); + return (int)a; +} + #ifdef HAVE_ALLOCA_H # include <alloca.h> # define xalloca(size) (alloca(size)) |