init: Do not segfault on big GIT_TEMPLATE_DIR environment variable

Signed-off-by: Frank Lichtenheld <flichtenheld@astaro.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/builtin-init-db.c b/builtin-init-db.c
index d30c3fe2ca542b061ab8b7a7696cdd5416e17147..6cc945d5075b03727f93194cd67122e6bff49764 100644 (file)
--- a/builtin-init-db.c
+++ b/builtin-init-db.c
@@ -122,8 +122,10 @@ static void copy_templates(const char *template_dir)
                template_dir = system_path(DEFAULT_GIT_TEMPLATE_DIR);
        if (!template_dir[0])
                return;
                template_dir = system_path(DEFAULT_GIT_TEMPLATE_DIR);
        if (!template_dir[0])
                return;

+       template_len = strlen(template_dir);
+       if (PATH_MAX <= (template_len+strlen("/config")))
+               die("insanely long template path %s", template_dir);

        strcpy(template_path, template_dir);
        strcpy(template_path, template_dir);

-       template_len = strlen(template_path);

        if (template_path[template_len-1] != '/') {
                template_path[template_len++] = '/';
                template_path[template_len] = 0;
        if (template_path[template_len-1] != '/') {
                template_path[template_len++] = '/';
                template_path[template_len] = 0;

diff --git a/t/t0001-init.sh b/t/t0001-init.sh
index 5ac0a273a94c033fbb7c48cb9a22e44c389e0f7d..e3d846420dc09e7b24876b291b9e546ac0628ed3 100755 (executable)
--- a/t/t0001-init.sh
+++ b/t/t0001-init.sh
@@ -199,4 +199,13 @@ test_expect_success 'init honors global core.sharedRepository' '
        x`git config -f shared-honor-global/.git/config core.sharedRepository`
 '
 
        x`git config -f shared-honor-global/.git/config core.sharedRepository`
 '
 

+test_expect_success 'init rejects insanely long --template' '
+       (
+               insane=$(printf "x%09999dx" 1) &&
+               mkdir test &&
+               cd test &&
+               test_must_fail git init --template=$insane
+       )
+'
+

 test_done
 test_done