)]}'
{
  "commit": "34ace8bad02bb14ecc5b631f7e3daaa7a9bba7d9",
  "tree": "921b5ae43cac8cf7ea4e3af626a06e6e558a7b13",
  "parents": [
    "24557209500e6ed618f04a8795a111a0c491a29c"
  ],
  "author": {
    "name": "Patrick Steinhardt",
    "email": "ps@pks.im",
    "time": "Thu Dec 01 15:45:27 2022 +0100"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Mon Dec 05 15:14:16 2022 +0900"
  },
  "message": "attr: fix out-of-bounds write when parsing huge number of attributes\n\nIt is possible to trigger an integer overflow when parsing attribute\nnames when there are more than 2^31 of them for a single pattern. This\ncan either lead to us dying due to trying to request too many bytes:\n\n     blob\u003d$(perl -e \u0027print \"f\" . \" a\u003d\" x 2147483649\u0027 | git hash-object -w --stdin)\n     git update-index --add --cacheinfo 100644,$blob,.gitattributes\n     git attr-check --all file\n\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n    \u003d\u003d1022\u003d\u003dERROR: AddressSanitizer: requested allocation size 0xfffffff800000032 (0xfffffff800001038 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)\n        #0 0x7fd3efabf411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77\n        #1 0x5563a0a1e3d3 in xcalloc wrapper.c:150\n        #2 0x5563a058d005 in parse_attr_line attr.c:384\n        #3 0x5563a058e661 in handle_attr_line attr.c:660\n        #4 0x5563a058eddb in read_attr_from_index attr.c:769\n        #5 0x5563a058ef12 in read_attr attr.c:797\n        #6 0x5563a058f24c in bootstrap_attr_stack attr.c:867\n        #7 0x5563a058f4a3 in prepare_attr_stack attr.c:902\n        #8 0x5563a05905da in collect_some_attrs attr.c:1097\n        #9 0x5563a059093d in git_all_attrs attr.c:1128\n        #10 0x5563a02f636e in check_attr builtin/check-attr.c:67\n        #11 0x5563a02f6c12 in cmd_check_attr builtin/check-attr.c:183\n        #12 0x5563a02aa993 in run_builtin git.c:466\n        #13 0x5563a02ab397 in handle_builtin git.c:721\n        #14 0x5563a02abb2b in run_argv git.c:788\n        #15 0x5563a02ac991 in cmd_main git.c:926\n        #16 0x5563a05432bd in main common-main.c:57\n        #17 0x7fd3ef82228f  (/usr/lib/libc.so.6+0x2328f)\n\n    \u003d\u003d1022\u003d\u003dHINT: if you don\u0027t care about these errors you may set allocator_may_return_null\u003d1\n    SUMMARY: AddressSanitizer: allocation-size-too-big /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77 in __interceptor_calloc\n    \u003d\u003d1022\u003d\u003dABORTING\n\nOr, much worse, it can lead to an out-of-bounds write because we\nunderallocate and then memcpy(3P) into an array:\n\n    perl -e \u0027\n        print \"A \" . \"\\rh\u003d\"x2000000000;\n        print \"\\rh\u003d\"x2000000000;\n        print \"\\rh\u003d\"x294967294 . \"\\n\"\n    \u0027 \u003e.gitattributes\n    git add .gitattributes\n    git commit -am \"evil attributes\"\n\n    $ git clone --quiet /path/to/repo\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n    \u003d\u003d15062\u003d\u003dERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002550 at pc 0x5555559884d5 bp 0x7fffffffbc60 sp 0x7fffffffbc58\n    WRITE of size 8 at 0x602000002550 thread T0\n        #0 0x5555559884d4 in parse_attr_line attr.c:393\n        #1 0x5555559884d4 in handle_attr_line attr.c:660\n        #2 0x555555988902 in read_attr_from_index attr.c:784\n        #3 0x555555988902 in read_attr_from_index attr.c:747\n        #4 0x555555988a1d in read_attr attr.c:800\n        #5 0x555555989b0c in bootstrap_attr_stack attr.c:882\n        #6 0x555555989b0c in prepare_attr_stack attr.c:917\n        #7 0x555555989b0c in collect_some_attrs attr.c:1112\n        #8 0x55555598b141 in git_check_attr attr.c:1126\n        #9 0x555555a13004 in convert_attrs convert.c:1311\n        #10 0x555555a95e04 in checkout_entry_ca entry.c:553\n        #11 0x555555d58bf6 in checkout_entry entry.h:42\n        #12 0x555555d58bf6 in check_updates unpack-trees.c:480\n        #13 0x555555d5eb55 in unpack_trees unpack-trees.c:2040\n        #14 0x555555785ab7 in checkout builtin/clone.c:724\n        #15 0x555555785ab7 in cmd_clone builtin/clone.c:1384\n        #16 0x55555572443c in run_builtin git.c:466\n        #17 0x55555572443c in handle_builtin git.c:721\n        #18 0x555555727872 in run_argv git.c:788\n        #19 0x555555727872 in cmd_main git.c:926\n        #20 0x555555721fa0 in main common-main.c:57\n        #21 0x7ffff73f1d09 in __libc_start_main ../csu/libc-start.c:308\n        #22 0x555555723f39 in _start (git+0x1cff39)\n\n    0x602000002552 is located 0 bytes to the right of 2-byte region [0x602000002550,0x602000002552) allocated by thread T0 here:\n        #0 0x7ffff768c037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154\n        #1 0x555555d7fff7 in xcalloc wrapper.c:150\n        #2 0x55555598815f in parse_attr_line attr.c:384\n        #3 0x55555598815f in handle_attr_line attr.c:660\n        #4 0x555555988902 in read_attr_from_index attr.c:784\n        #5 0x555555988902 in read_attr_from_index attr.c:747\n        #6 0x555555988a1d in read_attr attr.c:800\n        #7 0x555555989b0c in bootstrap_attr_stack attr.c:882\n        #8 0x555555989b0c in prepare_attr_stack attr.c:917\n        #9 0x555555989b0c in collect_some_attrs attr.c:1112\n        #10 0x55555598b141 in git_check_attr attr.c:1126\n        #11 0x555555a13004 in convert_attrs convert.c:1311\n        #12 0x555555a95e04 in checkout_entry_ca entry.c:553\n        #13 0x555555d58bf6 in checkout_entry entry.h:42\n        #14 0x555555d58bf6 in check_updates unpack-trees.c:480\n        #15 0x555555d5eb55 in unpack_trees unpack-trees.c:2040\n        #16 0x555555785ab7 in checkout builtin/clone.c:724\n        #17 0x555555785ab7 in cmd_clone builtin/clone.c:1384\n        #18 0x55555572443c in run_builtin git.c:466\n        #19 0x55555572443c in handle_builtin git.c:721\n        #20 0x555555727872 in run_argv git.c:788\n        #21 0x555555727872 in cmd_main git.c:926\n        #22 0x555555721fa0 in main common-main.c:57\n        #23 0x7ffff73f1d09 in __libc_start_main ../csu/libc-start.c:308\n\n    SUMMARY: AddressSanitizer: heap-buffer-overflow attr.c:393 in parse_attr_line\n    Shadow bytes around the buggy address:\n      0x0c047fff8450: fa fa 00 02 fa fa 00 07 fa fa fd fd fa fa 00 00\n      0x0c047fff8460: fa fa 02 fa fa fa fd fd fa fa 00 06 fa fa 05 fa\n      0x0c047fff8470: fa fa fd fd fa fa 00 02 fa fa 06 fa fa fa 05 fa\n      0x0c047fff8480: fa fa 07 fa fa fa fd fd fa fa 00 01 fa fa 00 02\n      0x0c047fff8490: fa fa 00 03 fa fa 00 fa fa fa 00 01 fa fa 00 03\n    \u003d\u003e0x0c047fff84a0: fa fa 00 01 fa fa 00 02 fa fa[02]fa fa fa fa fa\n      0x0c047fff84b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n      0x0c047fff84c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n      0x0c047fff84d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n      0x0c047fff84e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n      0x0c047fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa\n    Shadow byte legend (one shadow byte represents 8 application bytes):\n      Addressable:           00\n      Partially addressable: 01 02 03 04 05 06 07\n      Heap left redzone:       fa\n      Freed heap region:       fd\n      Stack left redzone:      f1\n      Stack mid redzone:       f2\n      Stack right redzone:     f3\n      Stack after return:      f5\n      Stack use after scope:   f8\n      Global redzone:          f9\n      Global init order:       f6\n      Poisoned by user:        f7\n      Container overflow:      fc\n      Array cookie:            ac\n      Intra object redzone:    bb\n      ASan internal:           fe\n      Left alloca redzone:     ca\n      Right alloca redzone:    cb\n      Shadow gap:              cc\n    \u003d\u003d15062\u003d\u003dABORTING\n\nFix this bug by using `size_t` instead to count the number of attributes\nso that this value cannot reasonably overflow without running out of\nmemory before already.\n\nReported-by: Markus Vervier \u003cmarkus.vervier@x41-dsec.de\u003e\nSigned-off-by: Patrick Steinhardt \u003cps@pks.im\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "4a10ba4d94abe82ff039da38fde3497d5e9ec8b3",
      "old_mode": 33188,
      "old_path": "attr.c",
      "new_id": "525f6da2013feb8d9ba609f47c6ce390fcfa7480",
      "new_mode": 33188,
      "new_path": "attr.c"
    }
  ]
}