summaryrefslogtreecommitdiffstatshomepage
path: root/cgit.c
diff options
context:
space:
mode:
authorJohn Keeping2013-04-01 19:03:34 +0100
committerJason A. Donenfeld2013-04-08 15:59:46 +0200
commitb1f17f168b91d709c0c0e62608de301a36f06da9 (patch)
tree9aff1fe903087cb5016ab2afdb32a7ca1cc139b2 /cgit.c
parent4b4a62d507adc61e20e75e2748301ef307a6c95f (diff)
downloadcgit-b1f17f168b91d709c0c0e62608de301a36f06da9.tar.gz
Fix out-of-bounds memory accesses with virtual_root=""
The CGit configuration variable virtual_root is normalized so that it does not have a trailing '/' character, but it is allowed to be empty (the empty string and NULL have different meanings here) and there is code that is insufficiently cautious when checking if it ends in a '/': if (virtual_root[strlen(virtual_root) - 1] != '/') Clearly this check is redundant, but rather than simply removing it we get a slight efficiency improvement by switching the normalization so that the virtual_root variable always ends in '/'. Do this with a new "ensure_end" helper. Signed-off-by: John Keeping <john@keeping.me.uk>
Diffstat (limited to 'cgit.c')
-rw-r--r--cgit.c11
1 files changed, 3 insertions, 8 deletions
diff --git a/cgit.c b/cgit.c
index ca3034c..6f75db1 100644
--- a/cgit.c
+++ b/cgit.c
@@ -155,9 +155,7 @@ static void config_cb(const char *name, const char *value)
else if (!strcmp(name, "strict-export"))
ctx.cfg.strict_export = xstrdup(value);
else if (!strcmp(name, "virtual-root")) {
- ctx.cfg.virtual_root = trim_end(value, '/');
- if (!ctx.cfg.virtual_root && (!strcmp(value, "/")))
- ctx.cfg.virtual_root = "";
+ ctx.cfg.virtual_root = ensure_end(value, '/');
} else if (!strcmp(name, "nocache"))
ctx.cfg.nocache = atoi(value);
else if (!strcmp(name, "noplainemail"))
@@ -833,11 +831,8 @@ int main(int argc, const char **argv)
* that virtual-root equals SCRIPT_NAME, minus any possibly
* trailing slashes.
*/
- if (!ctx.cfg.virtual_root && ctx.cfg.script_name) {
- ctx.cfg.virtual_root = trim_end(ctx.cfg.script_name, '/');
- if (!ctx.cfg.virtual_root)
- ctx.cfg.virtual_root = "";
- }
+ if (!ctx.cfg.virtual_root && ctx.cfg.script_name)
+ ctx.cfg.virtual_root = ensure_end(ctx.cfg.script_name, '/');
/* If no url parameter is specified on the querystring, lets
* use PATH_INFO as url. This allows cgit to work with virtual