Reject hexstring longer than 40-bytes in get_short_sha1()

diff --git a/sha1_name.c b/sha1_name.c
index c5a05faeb6b2bac74f4c5e06c5e397dc103bb190..6ffee22081aee3fc7b27b9ccc93c4c721652ec4b 100644 (file)
--- a/sha1_name.c
+++ b/sha1_name.c
@@ -84,7 +84,7 @@ static int find_short_packed_object(int len, const unsigned char *match, unsigne
                        int cmp;
 
                        nth_packed_object_sha1(p, mid, now);
-                       cmp = memcmp(match, now, 20);
+                       cmp = hashcmp(match, now);
                        if (!cmp) {
                                first = mid;
                                break;
@@ -103,10 +103,10 @@ static int find_short_packed_object(int len, const unsigned char *match, unsigne
                                    !match_sha(len, match, next)) {
                                        /* unique within this pack */
                                        if (!found) {
-                                               memcpy(found_sha1, now, 20);
+                                               hashcpy(found_sha1, now);
                                                found++;
                                        }
-                                       else if (memcmp(found_sha1, now, 20)) {
+                                       else if (hashcmp(found_sha1, now)) {
                                                found = 2;
                                                break;
                                        }
@@ -120,7 +120,7 @@ static int find_short_packed_object(int len, const unsigned char *match, unsigne
                }
        }
        if (found == 1)
-               memcpy(sha1, found_sha1, 20);
+               hashcpy(sha1, found_sha1);
        return found;
 }
 
@@ -140,13 +140,13 @@ static int find_unique_short_object(int len, char *canonical,
        if (1 < has_unpacked || 1 < has_packed)
                return SHORT_NAME_AMBIGUOUS;
        if (has_unpacked != has_packed) {
-               memcpy(sha1, (has_packed ? packed_sha1 : unpacked_sha1), 20);
+               hashcpy(sha1, (has_packed ? packed_sha1 : unpacked_sha1));
                return 0;
        }
        /* Both have unique ones -- do they match? */
-       if (memcmp(packed_sha1, unpacked_sha1, 20))
+       if (hashcmp(packed_sha1, unpacked_sha1))
                return SHORT_NAME_AMBIGUOUS;
-       memcpy(sha1, packed_sha1, 20);
+       hashcpy(sha1, packed_sha1);
        return 0;
 }
 
@@ -157,9 +157,9 @@ static int get_short_sha1(const char *name, int len, unsigned char *sha1,
        char canonical[40];
        unsigned char res[20];
 
-       if (len < MINIMUM_ABBREV)
+       if (len < MINIMUM_ABBREV || len > 40)
                return -1;
-       memset(res, 0, 20);
+       hashclr(res);
        memset(canonical, 'x', 40);
        for (i = 0; i < len ;i++) {
                unsigned char c = name[i];
@@ -191,7 +191,7 @@ const char *find_unique_abbrev(const unsigned char *sha1, int len)
        int status, is_null;
        static char hex[41];
 
-       is_null = !memcmp(sha1, null_sha1, 20);
+       is_null = is_null_sha1(sha1);
        memcpy(hex, sha1_to_hex(sha1), 40);
        if (len == 40 || !len)
                return hex;
@@ -279,7 +279,7 @@ static int get_sha1_basic(const char *str, int len, unsigned char *sha1)
                pathname = resolve_ref(git_path(*p, len, str), this_result, 1);
                if (pathname) {
                        if (!refs_found++)
-                               real_path = strdup(pathname);
+                               real_path = xstrdup(pathname);
                        if (!warn_ambiguous_refs)
                                break;
                }
@@ -320,13 +320,13 @@ static int get_parent(const char *name, int len,
        if (parse_commit(commit))
                return -1;
        if (!idx) {
-               memcpy(result, commit->object.sha1, 20);
+               hashcpy(result, commit->object.sha1);
                return 0;
        }
        p = commit->parents;
        while (p) {
                if (!--idx) {
-                       memcpy(result, p->item->object.sha1, 20);
+                       hashcpy(result, p->item->object.sha1);
                        return 0;
                }
                p = p->next;
@@ -347,9 +347,9 @@ static int get_nth_ancestor(const char *name, int len,
 
                if (!commit || parse_commit(commit) || !commit->parents)
                        return -1;
-               memcpy(sha1, commit->parents->item->object.sha1, 20);
+               hashcpy(sha1, commit->parents->item->object.sha1);
        }
-       memcpy(result, sha1, 20);
+       hashcpy(result, sha1);
        return 0;
 }
 
@@ -401,7 +401,7 @@ static int peel_onion(const char *name, int len, unsigned char *sha1)
                o = deref_tag(o, name, sp - name - 2);
                if (!o || (!o->parsed && !parse_object(o->sha1)))
                        return -1;
-               memcpy(sha1, o->sha1, 20);
+               hashcpy(sha1, o->sha1);
        }
        else {
                /* At this point, the syntax look correct, so
@@ -413,7 +413,7 @@ static int peel_onion(const char *name, int len, unsigned char *sha1)
                        if (!o || (!o->parsed && !parse_object(o->sha1)))
                                return -1;
                        if (o->type == expected_type) {
-                               memcpy(sha1, o->sha1, 20);
+                               hashcpy(sha1, o->sha1);
                                return 0;
                        }
                        if (o->type == OBJ_TAG)
@@ -431,6 +431,26 @@ static int peel_onion(const char *name, int len, unsigned char *sha1)
        return 0;
 }
 
+static int get_describe_name(const char *name, int len, unsigned char *sha1)
+{
+       const char *cp;
+
+       for (cp = name + len - 1; name + 2 <= cp; cp--) {
+               char ch = *cp;
+               if (hexval(ch) & ~0377) {
+                       /* We must be looking at g in "SOMETHING-g"
+                        * for it to be describe output.
+                        */
+                       if (ch == 'g' && cp[-1] == '-') {
+                               cp++;
+                               len -= cp - name;
+                               return get_short_sha1(cp, len, sha1, 1);
+                       }
+               }
+       }
+       return -1;
+}
+
 static int get_sha1_1(const char *name, int len, unsigned char *sha1)
 {
        int ret, has_suffix;
@@ -472,6 +492,12 @@ static int get_sha1_1(const char *name, int len, unsigned char *sha1)
        ret = get_sha1_basic(name, len, sha1);
        if (!ret)
                return 0;
+
+       /* It could be describe output that is "SOMETHING-gXXXX" */
+       ret = get_describe_name(name, len, sha1);
+       if (!ret)
+               return 0;
+
        return get_short_sha1(name, len, sha1, 0);
 }
 
@@ -520,7 +546,7 @@ int get_sha1(const char *name, unsigned char *sha1)
                            memcmp(ce->name, cp, namelen))
                                break;
                        if (ce_stage(ce) == stage) {
-                               memcpy(sha1, ce->sha1, 20);
+                               hashcpy(sha1, ce->sha1);
                                return 0;
                        }
                        pos++;