CVE-2018-8099: Double Free (CWE-415)
value: Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.
CWE description: The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CVSS v3 base score: 6.5
Published: 2018-03-14T00:29Z
Repository: https://github.com/libgit2/libgit2
Language: C
Files changed: src/index.c
Commit date: 2018-03-10 10:23:10 +0000
Commit message: index: convert `read_entry` to return entry size via an out-param

The function `read_entry` does not conform to our usual coding style of
returning stuff via the out parameter and to use the return value for
reporting errors. Due to most of our code conforming to that pattern, it
has become quite natural for us to actually return `-1` in case there is
any error, which has also slipped in with commit 5625d86b9 (index:
support index v4, 2016-05-17). As the function returns an `size_t` only,
though, the return value is wrapped around, causing the caller of
`read_tree` to continue with an invalid index entry. Ultimately, this
can lead to a double-free.

Improve code and fix the bug by converting the function to return the
index entry size via an out parameter and only using the return value to
indicate errors.

Reported-by: Krishna Ram Prakash R <krp@gtux.in>
Reported-by: Vivek Parikh <viv0411.parikh@gmail.com>

Diff: diff --git a/src/index.c b/src/index.c
index d98872adf..3ef892b7f 100644
--- a/src/index.c
+++ b/src/index.c
@@ -2297,12 +2297,13 @@ static size_t index_entry_size(size_t path_len, size_t varint_len, uint32_t flag
 			return entry_size(struct entry_short, path_len);
 #undef entry_size
 	}
 }
 
-static size_t read_entry(
+static int read_entry(
 	git_index_entry **out,
+	size_t *out_size,
 	git_index *index,
 	const void *buffer,
 	size_t buffer_size,
 	const char *last)
 {
@@ -2312,11 +2313,11 @@ static size_t read_entry(
 	git_index_entry entry = {{0}};
 	bool compressed = index->version >= INDEX_VERSION_NUMBER_COMP;
 	char *tmp_path = NULL;
 
 	if (INDEX_FOOTER_SIZE + minimal_entry_size > buffer_size)
-		return 0;
+		return -1;
 
 	/* buffer is not guaranteed to be aligned */
 	memcpy(&source, buffer, sizeof(struct entry_short));
 
 	entry.ctime.seconds = (git_time_t)ntohl(source.ctime.seconds);
@@ -2354,11 +2355,11 @@ static size_t read_entry(
 		if (path_length == 0xFFF) {
 			const char *path_end;
 
 			path_end = memchr(path_ptr, '\0', buffer_size);
 			if (path_end == NULL)
-				return 0;
+				return -1;
 
 			path_length = path_end - path_ptr;
 		}
 
 		entry_size = index_entry_size(path_length, 0, entry.flags);
@@ -2384,20 +2385,24 @@ static size_t read_entry(
 		memcpy(tmp_path + prefix_len, path_ptr + varint_len, suffix_len + 1);
 		entry_size = index_entry_size(suffix_len, varint_len, entry.flags);
 		entry.path = tmp_path;
 	}
 
+	if (entry_size == 0)
+		return -1;
+
 	if (INDEX_FOOTER_SIZE + entry_size > buffer_size)
-		return 0;
+		return -1;
 
 	if (index_entry_dup(out, index, &entry) < 0) {
 		git__free(tmp_path);
-		return 0;
+		return -1;
 	}
 
 	git__free(tmp_path);
-	return entry_size;
+	*out_size = entry_size;
+	return 0;
 }
 
 static int read_header(struct index_header *dest, const void *buffer)
 {
 	const struct index_header *source = buffer;
@@ -2497,14 +2502,13 @@ static int parse_index(git_index *index, const char *buffer, size_t buffer_size)
 		git_idxmap_resize(index->entries_map, header.entry_count);
 
 	/* Parse all the entries */
 	for (i = 0; i < header.entry_count && buffer_size > INDEX_FOOTER_SIZE; ++i) {
 		git_index_entry *entry = NULL;
-		size_t entry_size = read_entry(&entry, index, buffer, buffer_size, last);
+		size_t entry_size;
 
-		/* 0 bytes read means an object corruption */
-		if (entry_size == 0) {
+		if ((error = read_entry(&entry, &entry_size, index, buffer, buffer_size, last)) < 0) {
 			error = index_error_invalid("invalid entry");
 			goto done;
 		}
 
 		if ((error = git_vector_insert(&index->entries, entry)) < 0) {

Vulnerable code: static size_t read_entry(
		return 0;
				return 0;
		return 0;
		return 0;
	return entry_size;
		size_t entry_size = read_entry(&entry, index, buffer, buffer_size, last);
		/* 0 bytes read means an object corruption */
		if (entry_size == 0) {
Fixed code: static int read_entry(
	size_t *out_size,
		return -1;
				return -1;
	if (entry_size == 0)
		return -1;

		return -1;
		return -1;
	*out_size = entry_size;
	return 0;
		size_t entry_size;
		if ((error = read_entry(&entry, &entry_size, index, buffer, buffer_size, last)) < 0) {