summaryrefslogtreecommitdiff
path: root/cgit.h
diff options
context:
space:
mode:
authorJohn Keeping <john@keeping.me.uk>2013-04-01 18:03:34 +0000
committerJason A. Donenfeld <Jason@zx2c4.com>2013-04-08 13:59:46 +0000
commitb1f17f168b91d709c0c0e62608de301a36f06da9 (patch)
tree9aff1fe903087cb5016ab2afdb32a7ca1cc139b2 /cgit.h
parent4b4a62d507adc61e20e75e2748301ef307a6c95f (diff)
downloadcgit-b1f17f168b91d709c0c0e62608de301a36f06da9.tar
cgit-b1f17f168b91d709c0c0e62608de301a36f06da9.tar.gz
cgit-b1f17f168b91d709c0c0e62608de301a36f06da9.zip
Fix out-of-bounds memory accesses with virtual_root=""
The CGit configuration variable virtual_root is normalized so that it does not have a trailing '/' character, but it is allowed to be empty (the empty string and NULL have different meanings here) and there is code that is insufficiently cautious when checking if it ends in a '/': if (virtual_root[strlen(virtual_root) - 1] != '/') Clearly this check is redundant, but rather than simply removing it we get a slight efficiency improvement by switching the normalization so that the virtual_root variable always ends in '/'. Do this with a new "ensure_end" helper. Signed-off-by: John Keeping <john@keeping.me.uk>
Diffstat (limited to 'cgit.h')
-rw-r--r--cgit.h3
1 files changed, 2 insertions, 1 deletions
diff --git a/cgit.h b/cgit.h
index 081f669..fc3fc6f 100644
--- a/cgit.h
+++ b/cgit.h
@@ -190,7 +190,7 @@ struct cgit_config {
char *script_name;
char *section;
char *repository_sort;
- char *virtual_root;
+ char *virtual_root; /* Always ends with '/'. */
char *strict_export;
int cache_size;
int cache_dynamic_ttl;
@@ -300,6 +300,7 @@ extern int chk_positive(int result, char *msg);
extern int chk_non_negative(int result, char *msg);
extern char *trim_end(const char *str, char c);
+extern char *ensure_end(const char *str, char c);
extern char *strlpart(char *txt, int maxlen);
extern char *strrpart(char *txt, int maxlen);