Fossil

Differences From Artifact [a156e3c062]:

• File src/main.c — part of check-in [e120c2a9a7] at 2021-08-05 11:55:07 on branch trunk — Resolved invalid memory write in --args FILE handling when FILE contains embedded NULs, as reported in [forum:/forumpost/7b34eecc1b8cf5d2|forum post 7b34eecc1b8cf5d2]. Cause: mismatch between --args expansion's own line counting vs blob_line() counting. All bytes after the first embedded NUL are now effectively ignored. (user: stephan size: 117810)

To Artifact [b9eb72eed7]:

• File src/main.c — part of check-in [04a9e74a93] at 2021-08-05 17:06:13 on branch trunk — Minor doc fix for previous commit. No code changes. (user: stephan size: 117810)

474
475
476
477
478
479
480
481
482
483
484
485
486
487
488

  newArgv = fossil_malloc( sizeof(char*)*nArg );
  for(j=0; j<i; j++) newArgv[j] = g.argv[j];

  blob_rewind(&file);
  while( nLine-->0 && (n = blob_line(&file, &line))>0 ){
    /* Reminder: ^^^ nLine check avoids that embedded NUL bytes in the
    ** --args file causes nLine to be less than blob_line() will end
    ** up reporting in that case, which leads to an memory illegal
    ** write. See forum post
    ** https://fossil-scm.org/forum/forumpost/7b34eecc1b8c for
    ** details */
    if( n<1 ){
      /* Reminder: corner-case: a line with 1 byte and no newline. */
      continue;
    }

|

474
475
476
477
478
479
480
481
482
483
484
485
486
487
488

  newArgv = fossil_malloc( sizeof(char*)*nArg );
  for(j=0; j<i; j++) newArgv[j] = g.argv[j];

  blob_rewind(&file);
  while( nLine-->0 && (n = blob_line(&file, &line))>0 ){
    /* Reminder: ^^^ nLine check avoids that embedded NUL bytes in the
    ** --args file causes nLine to be less than blob_line() will end
    ** up reporting, as such a miscount leads to an illegal memory
    ** write. See forum post
    ** https://fossil-scm.org/forum/forumpost/7b34eecc1b8c for
    ** details */
    if( n<1 ){
      /* Reminder: corner-case: a line with 1 byte and no newline. */
      continue;
    }