backport(1.15): make `ParsePatch` more robust (#17580)

- Backport of https://github.com/go-gitea/gitea/pull/17573
release/v1.15
Gusted 2021-11-08 04:28:16 +01:00 committed by GitHub
parent 20ae184967
commit b661bbaed7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 29 additions and 1 deletions

View File

@ -831,7 +831,12 @@ parsingLoop:
case strings.HasPrefix(line, "--- "): case strings.HasPrefix(line, "--- "):
// Handle ambiguous filenames // Handle ambiguous filenames
if curFile.IsAmbiguous { if curFile.IsAmbiguous {
if len(line) > 6 && line[4] == 'a' { // The shortest string that can end up here is:
// "--- a\t\n" without the qoutes.
// This line has a len() of 7 but doesn't contain a oldName.
// So the amount that the line need is at least 8 or more.
// The code will otherwise panic for a out-of-bounds.
if len(line) > 7 && line[4] == 'a' {
curFile.OldName = line[6 : len(line)-1] curFile.OldName = line[6 : len(line)-1]
if line[len(line)-2] == '\t' { if line[len(line)-2] == '\t' {
curFile.OldName = curFile.OldName[:len(curFile.OldName)-1] curFile.OldName = curFile.OldName[:len(curFile.OldName)-1]
@ -1186,6 +1191,10 @@ func readFileName(rd *strings.Reader) (string, bool) {
_ = rd.UnreadByte() _ = rd.UnreadByte()
if char == '"' { if char == '"' {
fmt.Fscanf(rd, "%q ", &name) fmt.Fscanf(rd, "%q ", &name)
if len(name) == 0 {
log.Error("Reader has no file name: %v", rd)
return "", true
}
if name[0] == '\\' { if name[0] == '\\' {
name = name[1:] name = name[1:]
} }

View File

@ -539,3 +539,22 @@ func TestDiffToHTML_14231(t *testing.T) {
assertEqual(t, expected, output) assertEqual(t, expected, output)
} }
func TestNoCrashes(t *testing.T) {
type testcase struct {
gitdiff string
}
tests := []testcase{
{
gitdiff: "diff --git \n--- a\t\n",
},
{
gitdiff: "diff --git \"0\n",
},
}
for _, testcase := range tests {
// It shouldn't crash, so don't care about the output.
ParsePatch(setting.Git.MaxGitDiffLines, setting.Git.MaxGitDiffLineCharacters, setting.Git.MaxGitDiffFiles, strings.NewReader(testcase.gitdiff))
}
}