Re: [PATCH v4 2/3] commit-graph: fix buffer read-overflow

[Josh Steadmon <steadmon@google.com>]

On 2019.01.12 11:57, SZEDER Gábor wrote:
> On Thu, Dec 13, 2018 at 11:43:57AM -0800, Josh Steadmon wrote:
> > diff --git a/t/t5318-commit-graph.sh b/t/t5318-commit-graph.sh
> > index 5fe21db99f..a1b5a75882 100755
> > --- a/t/t5318-commit-graph.sh
> > +++ b/t/t5318-commit-graph.sh
> > @@ -366,21 +366,26 @@ GRAPH_OCTOPUS_DATA_OFFSET=$(($GRAPH_COMMIT_DATA_OFFSET + \
> >  GRAPH_BYTE_OCTOPUS=$(($GRAPH_OCTOPUS_DATA_OFFSET + 4))
> >  GRAPH_BYTE_FOOTER=$(($GRAPH_OCTOPUS_DATA_OFFSET + 4 * $NUM_OCTOPUS_EDGES))
> >  
> > -# usage: corrupt_graph_and_verify <position> <data> <string>
> > +# usage: corrupt_graph_and_verify <position> <data> <string> [<zero_pos>]
> >  # Manipulates the commit-graph file at the position
> > -# by inserting the data, then runs 'git commit-graph verify'
> > +# by inserting the data, optionally zeroing the file
> > +# starting at <zero_pos>, then runs 'git commit-graph verify'
> >  # and places the output in the file 'err'. Test 'err' for
> >  # the given string.
> >  corrupt_graph_and_verify() {
> >  	pos=$1
> >  	data="${2:-\0}"
> >  	grepstr=$3
> > +	orig_size=$(wc -c < $objdir/info/commit-graph) &&
> 
> A minor nit: this test script is unusually prudent about which
> directory/repository each test is executed in, as the first thing each
> test does is to 'cd' into the right directory.  (I think this is a
> Good Thing, and other test scripts should follow suit if they use a
> repo other than $TRASH_DIRECTORY.)  Though it doesn't cause any
> immediate issues (the previous test happens to use the same
> repository), the above line violates this, as it accesses the
> '.git/.../commit-graph' file ...
> 
> > +	zero_pos=${4:-${orig_size}} &&
> >  	cd "$TRASH_DIRECTORY/full" &&
> 
> ... before this line could ensure that it's in the right repository.

Thanks for the catch. Fixed in v5.