[PATCH 0/3] Fix segfault found by AFL

John Keeping john at keeping.me.uk
Sun Feb 19 13:44:58 CET 2017

I set AFL [0] loose on CGit's URL input yesterday and it managed to find
one issue that leads to a segfault via a null dereference.

Either of the first or third patches fixes the segfault, but I much
prefer the first as a solid fix, the third is a bit too subtle as a way
to ensure that the necessary invariant holds.

The second patch also fixes the route that AFL found, but it's possible
to get the same effect using broken out query parameters like
"?p=log&path=foo" but I'm including it because it seems to make sense to
use the value of the final "url" parameter we receive fully rather than
some combination of that and a previous URL.

[0] http://lcamtuf.coredump.cx/afl/

John Keeping (3):
  ui-shared: don't print path crumbs without a repo
  parsing: clear query path before starting
  cgit: don't set vpath unless repo is set

 cgit.c      | 12 ++++++------
 parsing.c   |  2 +-
 ui-shared.c |  2 +-
 3 files changed, 8 insertions(+), 8 deletions(-)


More information about the CGit mailing list