git.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Junio C Hamano <gitster@pobox.com>
To: "SZEDER Gábor" <szeder.dev@gmail.com>
Cc: Jeff King <peff@peff.net>, Luat Nguyen <root@l4w.io>,
	git@vger.kernel.org
Subject: Re: [PATCH 1/3] ewah_read_mmap: bounds-check mmap reads
Date: Fri, 15 Jun 2018 09:20:03 -0700	[thread overview]
Message-ID: <xmqq602k2f9o.fsf@gitster-ct.c.googlers.com> (raw)
In-Reply-To: <20180615091432.7155-1-szeder.dev@gmail.com> ("SZEDER Gábor"'s message of "Fri, 15 Jun 2018 11:14:32 +0200")

SZEDER Gábor <szeder.dev@gmail.com> writes:

>> +	bitmap=$(ls .git/objects/pack/*.bitmap) &&
>
> I think the 'ls' is unnecessary and this would do:
>
>   bitmap=.git/objects/pack/*.bitmap

Yuck.

>> +	test_when_finished "rm -f $bitmap" &&

OK, this will become "rm -f .git/objects/pack/*.bitmap" and then
eval that implements when-finished would make it work OK.

>> +	head -c 512 <$bitmap >$bitmap.tmp &&

The reading side would be OK but would the writing side also be
alright?

	makefile=Mak?file
	head -n 4 <$makefile >$makefile.tmp
	/bin/ls -t -1 | head -n 1
        Mak?file.tmp

Hmm...

>> +	mv $bitmap.tmp $bitmap &&

Likewise...

I said "yuck" because the original does not work if there happen to
be more than (or for that matter, less than) one '.bitmap' file
there.  But at least as long as there is one, it should work ;-)

  reply	other threads:[~2018-06-15 16:20 UTC|newest]

Thread overview: 58+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-06-14 22:59 security: potential out-of-bound read at ewah_io.c |ewah_read_mmap| Luat Nguyen
2018-06-15  3:28 ` Jeff King
2018-06-15  3:31   ` [PATCH 1/3] ewah_read_mmap: bounds-check mmap reads Jeff King
2018-06-15  9:14     ` SZEDER Gábor
2018-06-15 16:20       ` Junio C Hamano [this message]
2018-06-15 17:10         ` SZEDER Gábor
2018-06-15 17:21           ` Jeff King
2018-06-15 19:42             ` Junio C Hamano
2018-06-15 17:05     ` Junio C Hamano
2018-06-15 17:26       ` Jeff King
2018-06-15 19:44         ` Junio C Hamano
2018-06-16 14:35     ` SZEDER Gábor
2018-06-16 19:14       ` Jeff King
2018-06-15  3:31   ` [PATCH 2/3] ewah: drop ewah_deserialize function Jeff King
2018-06-15  3:32   ` [PATCH 3/3] ewah: drop ewah_serialize_native function Jeff King
2018-06-15 13:56     ` Ramsay Jones
2018-06-15 14:07       ` Ramsay Jones
2018-06-15 14:30         ` [PATCH 0/8] Delete unused methods in EWAH bitmap Derrick Stolee
2018-06-15 14:30           ` [PATCH 1/8] ewah/bitmap.c: delete unused 'bitmap_clear()' Derrick Stolee
2018-06-15 14:46             ` Ramsay Jones
2018-06-15 15:11               ` Derrick Stolee
2018-06-15 14:30           ` [PATCH 2/8] ewah/bitmap.c: delete unused 'bitmap_each_bit()' Derrick Stolee
2018-06-15 15:03             ` Ramsay Jones
2018-06-15 14:30           ` [PATCH 3/8] ewah_bitmap: delete unused 'ewah_and()' Derrick Stolee
2018-06-15 14:30           ` [PATCH 4/8] ewah_bitmap: delete unused 'ewah_and_not()' Derrick Stolee
2018-06-15 14:30           ` [PATCH 5/8] ewah_bitmap: delete unused 'ewah_not()' Derrick Stolee
2018-06-15 14:30           ` [PATCH 6/8] ewah_bitmap: delete unused 'ewah_or()' Derrick Stolee
2018-06-15 14:30           ` [PATCH 7/8] ewah_io: delete unused 'ewah_serialize()' Derrick Stolee
2018-06-15 14:30           ` [PATCH 8/8] ewah_io: delete unused 'ewah_serialize_native()' Derrick Stolee
2018-06-15 15:01             ` Ramsay Jones
2018-06-15 15:10               ` Derrick Stolee
2018-06-15 14:35           ` [PATCH 0/8] Delete unused methods in EWAH bitmap Derrick Stolee
2018-06-15 18:27           ` [PATCH v2 0/7] " Derrick Stolee
2018-06-15 18:27             ` [PATCH v2 1/7] ewah/bitmap.c: delete unused 'bitmap_clear()' Derrick Stolee
2018-06-15 18:27             ` [PATCH v2 2/7] ewah/bitmap.c: delete unused 'bitmap_each_bit()' Derrick Stolee
2018-06-15 18:27             ` [PATCH v2 3/7] ewah_bitmap: delete unused 'ewah_and()' Derrick Stolee
2018-06-15 18:27             ` [PATCH v2 4/7] ewah_bitmap: delete unused 'ewah_and_not()' Derrick Stolee
2018-06-15 18:27             ` [PATCH v2 5/7] ewah_bitmap: delete unused 'ewah_not()' Derrick Stolee
2018-06-15 18:27             ` [PATCH v2 6/7] ewah_bitmap: delete unused 'ewah_or()' Derrick Stolee
2018-06-15 18:27             ` [PATCH v2 7/7] ewah_io: delete unused 'ewah_serialize()' Derrick Stolee
2018-06-15 18:51             ` [PATCH v2 0/7] Delete unused methods in EWAH bitmap Junio C Hamano
2018-06-15 18:56               ` Derrick Stolee
2018-06-15 19:48                 ` Junio C Hamano
2018-06-15 20:35                   ` Jeff King
2018-06-15 14:15       ` [PATCH 3/3] ewah: drop ewah_serialize_native function Derrick Stolee
2018-06-15 17:51         ` Jeff King
2018-06-15 18:33           ` Junio C Hamano
2018-06-15 18:46             ` Jeff King
2018-06-15  3:44   ` [PATCH 4/3] ewah: adjust callers of ewah_read_mmap() Jeff King
2018-06-15 11:23     ` Derrick Stolee
2018-06-15 16:41       ` Junio C Hamano
2018-06-15 17:31         ` Jeff King
2018-06-15 18:23           ` Derrick Stolee
2018-06-15 20:38             ` Jeff King
2018-06-15 17:12     ` Junio C Hamano
2018-06-15 16:11   ` security: potential out-of-bound read at ewah_io.c |ewah_read_mmap| Junio C Hamano
2018-06-19 19:00 ` Dyer, Edwin
2018-06-19 19:56   ` Jeff King

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=xmqq602k2f9o.fsf@gitster-ct.c.googlers.com \
    --to=gitster@pobox.com \
    --cc=git@vger.kernel.org \
    --cc=peff@peff.net \
    --cc=root@l4w.io \
    --cc=szeder.dev@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).