diff options
| author | Lars Hjemli | 2007-12-03 00:39:20 +0100 |
|---|---|---|
| committer | Lars Hjemli | 2007-12-03 00:39:20 +0100 |
| commit | 2216fd6472fe183439df1a39c1c06974abc3f150 (patch) | |
| tree | 063180038252f9a7116bed384aab20717e4990e4 | |
| parent | 7b346647c9d8cc3b4acccecc3ede526dc4b2fb06 (diff) | |
| download | cgit-2216fd6472fe183439df1a39c1c06974abc3f150.tar.gz | |
Compare string lengths when parsing the snapshot mask
We used to rely on the result from strncmp() without comparing the length of
the strings involved. Even worse, any single-character format specifier would
enable zip-format due to the optional '.'-prefix since the length of the
mask then would become zero.
Noticed-by: Evan Martin <sys@neugierig.org>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>
Diffstat (limited to '')
| -rw-r--r-- | ui-snapshot.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/ui-snapshot.c b/ui-snapshot.c index 4d1aa88..dfedd8f 100644 --- a/ui-snapshot.c +++ b/ui-snapshot.c @@ -130,7 +130,7 @@ int cgit_parse_snapshots_mask(const char *str) { const struct snapshot_archive_t* sat; static const char *delim = " \t,:/|;"; - int f, tl, rv = 0; + int f, tl, sl, rv = 0; /* favor legacy setting */ if(atoi(str)) @@ -142,8 +142,9 @@ int cgit_parse_snapshots_mask(const char *str) break; for(f=0; f<snapshot_archives_len; f++) { sat = &snapshot_archives[f]; - if(!(strncmp(sat->suffix, str, tl) && - strncmp(sat->suffix+1, str, tl-1))) { + sl = strlen(sat->suffix); + if((tl == sl && !strncmp(sat->suffix, str, tl)) || + (tl == sl-1 && !strncmp(sat->suffix+1, str, tl-1))) { rv |= sat->bit; break; } |