From d4e85a1afe0a3310a3c8336c2824775901cc27d7 Mon Sep 17 00:00:00 2001 From: Michael Haggerty Date: Fri, 23 Sep 2011 15:38:36 +0200 Subject: get_sha1_hex(): do not read past a NUL character Previously, get_sha1_hex() would read one character past the end of a null-terminated string whose strlen was an even number less than 40. Although the function correctly returned -1 in these cases, the extra memory access might have been to uninitialized (or even, conceivably, unallocated) memory. Add a check to avoid reading past the end of a string. This problem was discovered by Thomas Rast using valgrind. Signed-off-by: Michael Haggerty Signed-off-by: Junio C Hamano --- hex.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'hex.c') diff --git a/hex.c b/hex.c index bb402fbaa2..9ebc050637 100644 --- a/hex.c +++ b/hex.c @@ -39,7 +39,15 @@ int get_sha1_hex(const char *hex, unsigned char *sha1) { int i; for (i = 0; i < 20; i++) { - unsigned int val = (hexval(hex[0]) << 4) | hexval(hex[1]); + unsigned int val; + /* + * hex[1]=='\0' is caught when val is checked below, + * but if hex[0] is NUL we have to avoid reading + * past the end of the string: + */ + if (!hex[0]) + return -1; + val = (hexval(hex[0]) << 4) | hexval(hex[1]); if (val & ~0xff) return -1; *sha1++ = val; -- cgit v1.3-5-g9baa