blame: don't overflow time buffer
authorJeff King <peff@peff.net>
Thu, 8 Dec 2011 10:25:54 +0000 (05:25 -0500)
committerJunio C Hamano <gitster@pobox.com>
Wed, 14 Dec 2011 05:09:06 +0000 (21:09 -0800)
When showing the raw timestamp, we format the numeric
seconds-since-epoch into a buffer, followed by the timezone
string. This string has come straight from the commit
object. A well-formed object should have a timezone string
of only a few bytes, but we could be operating on data
pushed by a malicious user.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
builtin/blame.c
index 26a5d424b8ceb0fd403a492e46e3637fd35068ba..3e1f7e1e453f6ecc28fb910686c6580e77929556 100644 (file)
@@ -1598,7 +1598,7 @@ static const char *format_time(unsigned long time, const char *tz_str,
        int tz;
 
        if (show_raw_time) {
-               sprintf(time_buf, "%lu %s", time, tz_str);
+               snprintf(time_buf, sizeof(time_buf), "%lu %s", time, tz_str);
        }
        else {
                tz = atoi(tz_str);