Skip to content
Permalink
Browse files Browse the repository at this point in the history
index: error out on unreasonable prefix-compressed path lengths
When computing the complete path length from the encoded
prefix-compressed path, we end up just allocating the complete path
without ever checking what the encoded path length actually is. This can
easily lead to a denial of service by just encoding an unreasonable long
path name inside of the index. Git already enforces a maximum path
length of 4096 bytes. As we also have that enforcement ready in some
places, just make sure that the resulting path is smaller than
GIT_PATH_MAX.

Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reported-by: Vivek Parikh <viv0411.parikh@gmail.com>
  • Loading branch information
pks-t committed Mar 10, 2018
1 parent 3207ddb commit 3db1af1
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions src/index.c
Expand Up @@ -2379,6 +2379,10 @@ static int read_entry(

GITERR_CHECK_ALLOC_ADD(&path_len, prefix_len, suffix_len);
GITERR_CHECK_ALLOC_ADD(&path_len, path_len, 1);

if (path_len > GIT_PATH_MAX)
return index_error_invalid("unreasonable path length");

tmp_path = git__malloc(path_len);
GITERR_CHECK_ALLOC(tmp_path);

Expand Down

0 comments on commit 3db1af1

Please sign in to comment.