about summary refs log tree commit diff
path: root/COPYING
diff options
context:
space:
mode:
authorJohn Keeping <john@keeping.me.uk>2013-04-01 19:03:34 +0100
committerJason A. Donenfeld <Jason@zx2c4.com>2013-04-08 15:59:46 +0200
commitb1f17f168b91d709c0c0e62608de301a36f06da9 (patch)
tree9aff1fe903087cb5016ab2afdb32a7ca1cc139b2 /COPYING
parentui-refs.c: Refactor print_tag() (diff)
downloadcgit-pink-b1f17f168b91d709c0c0e62608de301a36f06da9.tar.gz
cgit-pink-b1f17f168b91d709c0c0e62608de301a36f06da9.zip
Fix out-of-bounds memory accesses with virtual_root=""
The CGit configuration variable virtual_root is normalized so that it
does not have a trailing '/' character, but it is allowed to be empty
(the empty string and NULL have different meanings here) and there is
code that is insufficiently cautious when checking if it ends in a '/':

	if (virtual_root[strlen(virtual_root) - 1] != '/')

Clearly this check is redundant, but rather than simply removing it we
get a slight efficiency improvement by switching the normalization so
that the virtual_root variable always ends in '/'.  Do this with a new
"ensure_end" helper.

Signed-off-by: John Keeping <john@keeping.me.uk>
Diffstat (limited to 'COPYING')
0 files changed, 0 insertions, 0 deletions
uname" inclusion optionalJohn Keeping 2015-08-13ui-shared: show full date in tooltip if longer ago than max_relativeJohn Keeping 2015-08-13ui-shared: use common function in print_rel_date()John Keeping 2015-08-13ui-shared: extract date formatting to a functionJohn Keeping 2015-08-13filter: don't use dlsym unnecessarilyJohn Keeping 2015-08-13ui-tree: use "sane" isgraph()John Keeping 2015-08-13cgit.h: move stdbool.h from ui-shared.hJohn Keeping 2015-08-13cache.c: fix header orderJohn Keeping 2015-08-13configfile.c: don't include system headers directlyJohn Keeping 2015-08-13Remove redundant includesJohn Keeping 2015-08-13Makefile: include Git's config.mak.unameJohn Keeping 2015-08-13tests: allow shell to be overriddenJohn Keeping 2015-08-13redirect: cleanlinessJason A. Donenfeld 2015-08-13redirect: be more careful for different cgi setupsJason A. Donenfeld 2015-08-12ui-log: fix double countingJohn Keeping 2015-08-12log: allow users to follow a fileJohn Keeping 2015-08-12shared: make cgit_diff_tree_cb publicJohn Keeping 2015-08-12t0110: Chain together using &&Jason A. Donenfeld 2015-08-12about: always ensure page has a trailing slashJason A. Donenfeld 2015-08-12filters: apply HTML escapingLazaros Koromilas 2015-08-12git: update to v2.5.0Christian Hesse 2015-08-12Fix processing of repo.hide and repo.ignoreDaniel Reichelt