From 21870efc4aab4732ba2c422ef116597c54e4a8ec Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Thu, 30 Aug 2018 03:09:45 -0400 Subject: patch-delta: fix oob read If `cmd` is in the range [0x01,0x7f] and `cmd > top-data`, the `memcpy(out, data, cmd)` can copy out-of-bounds data from after `delta_buf` into `dst_buf`. This is not an exploitable bug because triggering the bug increments the `data` pointer beyond `top`, causing the `data != top` sanity check after the loop to trigger and discard the destination buffer - which means that the result of the out-of-bounds read is never used for anything. Signed-off-by: Jann Horn Signed-off-by: Jeff King Reviewed-by: Nicolas Pitre Signed-off-by: Junio C Hamano --- patch-delta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'patch-delta.c') diff --git a/patch-delta.c b/patch-delta.c index 56e0a5ede2..b937afd2c9 100644 --- a/patch-delta.c +++ b/patch-delta.c @@ -56,7 +56,7 @@ void *patch_delta(const void *src_buf, unsigned long src_size, out += cp_size; size -= cp_size; } else if (cmd) { - if (cmd > size) + if (cmd > size || cmd > top - data) break; memcpy(out, data, cmd); out += cmd; -- cgit v1.2.3