cgit: heap buffer overflow

[Jason A. Donenfeld]

Hey oss-sec,

The original author and maintainer of cgit, Lars Hjemli, has been MIA
for the last several months, and nobody I've talked to seems to know
what's happened. Because I've previously been involved with some cgit
things, I'm maintaining a tree of my own to which folks on the cgit
mailing list are now sending patches. It'd be a bit presumptuous to
call myself the new maintainer, but I am trying to keep the project
alive and healthy until Lars returns from wherever he is.

Jim Meyering from Redhat has written to the cgit mailing list with a
detailed analysis and a two line commit fixing a heap buffer overflow.
At the minimum, it's a denial of service, and in the worst case, it
might lead to to a remote shell. If anyone has any tricks on how to
exploit it successfully, I'd be interested to hear them.

You can read his analysis and look at the commit here [1] and a Redhat
bug report here [2].

If this oss-sec finds it concerning enough, I can tag a
non-Lars-approved release and post links to new tarballs for folks.
But there's a chance that exploitation isn't feasible, as Jim has
written in his report, in which case I'd like to hold off on making
any non-Lars-approved releases for a bit.

Thanks,
Jason

[1] http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec
[2] https://bugzilla.redhat.com/show_bug.cgi?id=820733