CVE-2016-2324 (C, published 2016-04-08T14:59Z)
Description: value: Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/git/git
Files changed:
builtin/pack-objects.c
builtin/rev-list.c
list-objects.c
list-objects.h
pack-bitmap-write.c
pack-bitmap.c
reachable.c
revision.c
revision.h
Commit message: list-objects: pass full pathname to callbacks

When we find a blob at "a/b/c", we currently pass this to
our show_object_fn callbacks as two components: "a/b/" and
"c". Callbacks which want the full value then call
path_name(), which concatenates the two. But this is an
inefficient interface; the path is a strbuf, and we could
simply append "c" to it temporarily, then roll back the
length, without creating a new copy.

So we could improve this by teaching the callsites of
path_name() this trick (and there are only 3). But we can
also notice that no callback actually cares about the
broken-down representation, and simply pass each callback
the full path "a/b/c" as a string. The callback code becomes
even simpler, then, as we do not have to worry about freeing
an allocated buffer, nor rolling back our modification to
the strbuf.

This is theoretically less efficient, as some callbacks
would not bother to format the final path component. But in
practice this is not measurable. Since we use the same
strbuf over and over, our work to grow it is amortized, and
we really only pay to memcpy a few bytes.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>


Vulnerable code:
static void show_object(struct object *obj,
			struct strbuf *path, const char *last,
			void *data)
	char *name = path_name(path, last);


	/*
	 * We will have generated the hash from the name,
	 * but not saved a pointer to it - we can free it
	 */
	free((char *)name);
				 struct strbuf *path,
				 const char *last,
static void finish_object(struct object *obj,
			  struct strbuf *path, const char *name,
			  void *cb_data)
static void show_object(struct object *obj,
			struct strbuf *path, const char *component,
			void *cb_data)
	finish_object(obj, path, component, cb_data);
	show_object_with_name(stdout, obj, path, component);
	show(obj, path, name, cb_data);
	show(obj, base, name, cb_data);

			show_object(obj, NULL, name, data);
				     NULL, path, data);
typedef void (*show_object_fn)(struct object *, struct strbuf *, const char *, void *);
static void show_object(struct object *object, struct strbuf *path,
			const char *last, void *data)
static void show_object(struct object *object, struct strbuf *path,
			const char *last, void *data)
	if (bitmap_pos < 0) {
		char *name = path_name(path, last);
		free(name);
	}
static void test_show_object(struct object *object,
			     struct strbuf *path,
			     const char *last, void *data)
static void mark_object(struct object *obj, struct strbuf *path,
			const char *name, void *data)
	mark_object(&c->object, NULL, NULL, data);
char *path_name(struct strbuf *path, const char *name)
	struct strbuf ret = STRBUF_INIT;
	if (path)
		strbuf_addbuf(&ret, path);
	strbuf_addstr(&ret, name);
	return strbuf_detach(&ret, NULL);
}

void show_object_with_name(FILE *out, struct object *obj,
			   struct strbuf *path, const char *component)
{
	char *name = path_name(path, component);
	char *p;

	free(name);
extern void show_object_with_name(FILE *, struct object *,
				  struct strbuf *, const char *);

Fixed code:
static void show_object(struct object *obj, const char *name, void *data)
				 const char *name,
static void finish_object(struct object *obj, const char *name, void *cb_data)
static void show_object(struct object *obj, const char *name, void *cb_data)
	finish_object(obj, name, cb_data);
	show_object_with_name(stdout, obj, name);
	size_t pathlen;

	pathlen = path->len;
	strbuf_addstr(path, name);
	show(obj, path->buf, cb_data);
	strbuf_setlen(path, pathlen);
	show(obj, base->buf, cb_data);
			show_object(obj, name, data);
				     &base, path, data);
typedef void (*show_object_fn)(struct object *, const char *, void *);
static void show_object(struct object *object, const char *name, void *data)
static void show_object(struct object *object, const char *name, void *data)
	if (bitmap_pos < 0)
static void test_show_object(struct object *object, const char *name,
			     void *data)
static void mark_object(struct object *obj, const char *name, void *data)
	mark_object(&c->object, NULL, data);
void show_object_with_name(FILE *out, struct object *obj, const char *name)
	const char *p;
extern void show_object_with_name(FILE *, struct object *, const char *);