Welcome to mirror list, hosted at ThFree Co, Russian Federation.

git.zx2c4.com/cgit.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohn Keeping <john@keeping.me.uk>2013-04-01 22:03:34 +0400
committerJason A. Donenfeld <Jason@zx2c4.com>2013-04-08 17:59:46 +0400
commitb1f17f168b91d709c0c0e62608de301a36f06da9 (patch)
tree9aff1fe903087cb5016ab2afdb32a7ca1cc139b2 /ui-shared.c
parent4b4a62d507adc61e20e75e2748301ef307a6c95f (diff)
Fix out-of-bounds memory accesses with virtual_root=""
The CGit configuration variable virtual_root is normalized so that it does not have a trailing '/' character, but it is allowed to be empty (the empty string and NULL have different meanings here) and there is code that is insufficiently cautious when checking if it ends in a '/': if (virtual_root[strlen(virtual_root) - 1] != '/') Clearly this check is redundant, but rather than simply removing it we get a slight efficiency improvement by switching the normalization so that the virtual_root variable always ends in '/'. Do this with a new "ensure_end" helper. Signed-off-by: John Keeping <john@keeping.me.uk>
Diffstat (limited to 'ui-shared.c')
-rw-r--r--ui-shared.c14
1 files changed, 5 insertions, 9 deletions
diff --git a/ui-shared.c b/ui-shared.c
index 945d560..c1f3c20 100644
--- a/ui-shared.c
+++ b/ui-shared.c
@@ -57,7 +57,7 @@ const char *cgit_hosturl()
const char *cgit_rooturl()
{
if (ctx.cfg.virtual_root)
- return fmt("%s/", ctx.cfg.virtual_root);
+ return ctx.cfg.virtual_root;
else
return ctx.cfg.script_name;
}
@@ -65,7 +65,7 @@ const char *cgit_rooturl()
char *cgit_repourl(const char *reponame)
{
if (ctx.cfg.virtual_root) {
- return fmt("%s/%s/", ctx.cfg.virtual_root, reponame);
+ return fmt("%s%s/", ctx.cfg.virtual_root, reponame);
} else {
return fmt("?r=%s", reponame);
}
@@ -78,7 +78,7 @@ char *cgit_fileurl(const char *reponame, const char *pagename,
char *delim;
if (ctx.cfg.virtual_root) {
- tmp = fmt("%s/%s/%s/%s", ctx.cfg.virtual_root, reponame,
+ tmp = fmt("%s%s/%s/%s", ctx.cfg.virtual_root, reponame,
pagename, (filename ? filename:""));
delim = "?";
} else {
@@ -126,11 +126,9 @@ static void site_url(const char *page, const char *search, const char *sort, int
{
char *delim = "?";
- if (ctx.cfg.virtual_root) {
+ if (ctx.cfg.virtual_root)
html_attr(ctx.cfg.virtual_root);
- if (ctx.cfg.virtual_root[strlen(ctx.cfg.virtual_root) - 1] != '/')
- html("/");
- } else
+ else
html(ctx.cfg.script_name);
if (page) {
@@ -201,8 +199,6 @@ static char *repolink(const char *title, const char *class, const char *page,
html(" href='");
if (ctx.cfg.virtual_root) {
html_url_path(ctx.cfg.virtual_root);
- if (ctx.cfg.virtual_root[strlen(ctx.cfg.virtual_root) - 1] != '/')
- html("/");
html_url_path(ctx.repo->url);
if (ctx.repo->url[strlen(ctx.repo->url) - 1] != '/')
html("/");