gitweb: Secure against commit-ish/tree-ish with the same name as path

diff --git a/tree-walk.c b/tree-walk.c
index 9f7abb7cb352241191e395e3967730f3bdcf6d55..14cc5aea6c4eefbf4b0fa9c72ccb70ec550b44b4 100644 (file)
--- a/tree-walk.c
+++ b/tree-walk.c
@@ -37,32 +37,77 @@ static void entry_extract(struct tree_desc *t, struct name_entry *a)
 
 void update_tree_entry(struct tree_desc *desc)
 {
-       void *buf = desc->buf;
+       const void *buf = desc->buf;
        unsigned long size = desc->size;
        int len = strlen(buf) + 1 + 20;
 
        if (size < len)
                die("corrupt tree file");
-       desc->buf = buf + len;
+       desc->buf = (char *) buf + len;
        desc->size = size - len;
 }
 
+static const char *get_mode(const char *str, unsigned int *modep)
+{
+       unsigned char c;
+       unsigned int mode = 0;
+
+       while ((c = *str++) != ' ') {
+               if (c < '0' || c > '7')
+                       return NULL;
+               mode = (mode << 3) + (c - '0');
+       }
+       *modep = mode;
+       return str;
+}
+
 const unsigned char *tree_entry_extract(struct tree_desc *desc, const char **pathp, unsigned int *modep)
 {
-       void *tree = desc->buf;
+       const void *tree = desc->buf;
        unsigned long size = desc->size;
        int len = strlen(tree)+1;
-       const unsigned char *sha1 = tree + len;
-       const char *path = strchr(tree, ' ');
+       const unsigned char *sha1 = (unsigned char *) tree + len;
+       const char *path;
        unsigned int mode;
 
-       if (!path || size < len + 20 || sscanf(tree, "%o", &mode) != 1)
+       path = get_mode(tree, &mode);
+       if (!path || size < len + 20)
                die("corrupt tree file");
-       *pathp = path+1;
+       *pathp = path;
        *modep = canon_mode(mode);
        return sha1;
 }
 
+int tree_entry(struct tree_desc *desc, struct name_entry *entry)
+{
+       const void *tree = desc->buf;
+       const char *path;
+       unsigned long len, size = desc->size;
+
+       if (!size)
+               return 0;
+
+       path = get_mode(tree, &entry->mode);
+       if (!path)
+               die("corrupt tree file");
+
+       entry->path = path;
+       len = strlen(path);
+       entry->pathlen = len;
+
+       path += len + 1;
+       entry->sha1 = (const unsigned char *) path;
+
+       path += 20;
+       len = path - (char *) tree;
+       if (len > size)
+               die("corrupt tree file");
+
+       desc->buf = path;
+       desc->size = size - len;
+       return 1;
+}
+
 void traverse_trees(int n, struct tree_desc *t, const char *base, traverse_callback_t callback)
 {
        struct name_entry *entry = xmalloc(n*sizeof(*entry));
@@ -134,7 +179,7 @@ static int find_tree_entry(struct tree_desc *t, const char *name, unsigned char
                if (cmp < 0)
                        break;
                if (entrylen == namelen) {
-                       memcpy(result, sha1, 20);
+                       hashcpy(result, sha1);
                        return 0;
                }
                if (name[entrylen] != '/')
@@ -142,7 +187,7 @@ static int find_tree_entry(struct tree_desc *t, const char *name, unsigned char
                if (!S_ISDIR(*mode))
                        break;
                if (++entrylen == namelen) {
-                       memcpy(result, sha1, 20);
+                       hashcpy(result, sha1);
                        return 0;
                }
                return get_tree_entry(sha1, name + entrylen, result, mode);