do not infloop on a query ending in %XY, for invalid hex X or Y - cgit-pink

diff options

author	Jim Meyering <meyering@redhat.com>	2011-02-28 12:18:57 +0100
committer	Lars Hjemli <hjemli@gmail.com>	2011-03-05 13:38:34 +0100
commit	fc384b16fb9787380746000d3cea2d53fccc548e (patch)
tree	d0a77d911c111e49904ab2f5061af22417f2b698 /git
parent	ui-shared: silence warning (diff)
download	cgit-pink-fc384b16fb9787380746000d3cea2d53fccc548e.tar.gz cgit-pink-fc384b16fb9787380746000d3cea2d53fccc548e.zip

do not infloop on a query ending in %XY, for invalid hex X or Y

When a query ends in say %gg, (or any invalid hex) e.g.,
http://git.gnome.org/browse/gdlmm/commit/?id=%gg
convert_query_hexchar calls memmove(txt, txt+3, 0), and then returns
txt-1, so the loop in http_parse_querystring never terminates.  The
solution is to make the memmove also copy the trailing NUL.
* html.c (convert_query_hexchar): Fix off-by-one error.

Signed-off-by: Lars Hjemli <hjemli@gmail.com>

Diffstat (limited to 'git')

0 files changed, 0 insertions, 0 deletions

ogsubject'>Set original socket CLOEXECJune McEnroe 2021-09-24Consume request headers using MSG_PEEKJune McEnroe Use MSG_PEEK to determine where the request headers end and consume only up to there, leaving the CGI process to read any request body directly from the socket. 2021-09-24Set only HTTP_HOSTJune McEnroe And only because kcgi expects it. This is what I wrote originally, because every HTTP_ variable should be unset between each request, but this doesn't track them. 2021-09-23Scroll by single lines in xtermJune McEnroe 2021-09-23Hide htop "function bar"June McEnroe Useless thing... 2021-09-23Allow FocusEvents in xtermJune McEnroe Oops! This whole time I thought OpenBSD xterm for some reason didn't support focus events. It turns out allowMouseOps: false disables them by default. Replace the disallowedMouseOps list with everything but. 2021-09-23Use NI_NUMERICSERVJune McEnroe 2021-09-23Make up build away from FreeBSDJune McEnroe 2021-09-23Add quickJune McEnroe 2021-09-23Add The HobbitJune McEnroe Surprisingly good for something written by a man like a hundred years ago! 2021-09-22Remove PSF fontsJune McEnroe They were fun to make but I never actually used them. 2021-09-22Remove Linux-specific utilitiesJune McEnroe I haven't used these in ages. 2021-09-22Call sandbox in CGI modeJune McEnroe Otherwise upload won't actually work. 2021-09-22Support HTTP PUT in upJune McEnroe For use by Palaver[1]. Unfortunately, at least in the current App Store version of Palaver, this doesn't work correctly with basic auth. [1]: https://palaverapp.com/guides/commands/set.html#ui-image_service 2021-09-22Remove default faviconJune McEnroe I hate these things and also this one sucks. 2021-09-21Use Z_FILTERED strategyJune McEnroe 2021-09-21Recalculate various lengths only as neededJune McEnroe This actually speeds things up quite a bit, saving roughly a second on a big PNG screenshot. Almost all the remaining time is spent in deflate. 2021-09-21Rewrite pngo, add explicit optionsJune McEnroe Interesting to see how my code habits have changed. 2021-09-16Fix /* **/ comment matchingJune McEnroe 2021-09-15Remove typer, add downgrade to READMEJune McEnroe 2021-09-15Set bot mode on downgradeJune McEnroe 2021-09-15Enter capsicum in downgradeJune McEnroe 2021-09-15Factor out common parts of downgrade messagesJune McEnroe Also bump the message cap to 1024 because that is ostensibly useful for replying to older messages. 2021-09-14Add downgrade IRC botJune McEnroe 2021-09-14Sort by title if authors matchJune McEnroe There are probably better things to sort by but title definitely always exists. 2021-09-13Swap-remove tags as they're foundJune McEnroe This makes it even faster. From ~1s on a sqlite3.c amalgamation to ~0.85s. 2021-09-12Replace htagml regex with strncmpJune McEnroe Since ctags only ever produces regular expressions of the form /^re$/ or /^re/ with no other special characters, instead unescape the pattern and simply use strncmp. Running on a sqlite3.c amalgamation, the regex version takes ~37s while the strncmp version takes ~1s, producing identical output. Big win! 2021-09-11Also defer printing comment for lone close-parensJune McEnroe 2021-09-10Publish "git-comment"June McEnroe 2021-09-10Add git comment --pretty optionJune McEnroe 2021-09-08Defer printing comment if line is blank or closing braceJune McEnroe This fixes badly indented comments. 2021-09-08Up default min-repeat to 30 linesJune McEnroe 2021-09-08Handle dirty lines in git-commentJune McEnroe 2021-09-08Document and install git-commentJune McEnroe 2021-09-08Add repeat and all options to git-commentJune McEnroe 2021-09-08Add group threshold to git-commentJune McEnroe


context:
space:
mode: