Fix out-of-bounds memory accesses with virtual_root=""

[ps-cgit] / cgit.c

diff --git a/cgit.c b/cgit.c
index ade85ea0976640c49ce71e8a718e5f5c2d7978ac..6f75db14a5c64e0d1684edaf876dd61667938c0b 100644 (file)
--- a/cgit.c
+++ b/cgit.c
@@ -18,7 +18,7 @@
 
 const char *cgit_version = CGIT_VERSION;
 
-void add_mimetype(const char *name, const char *value)
+static void add_mimetype(const char *name, const char *value)
 {
        struct string_list_item *item;
 
@@ -26,7 +26,7 @@ void add_mimetype(const char *name, const char *value)
        item->util = xstrdup(value);
 }
 
-struct cgit_filter *new_filter(const char *cmd, filter_type filtertype)
+static struct cgit_filter *new_filter(const char *cmd, filter_type filtertype)
 {
        struct cgit_filter *f;
        int args_size = 0;
@@ -58,7 +58,7 @@ struct cgit_filter *new_filter(const char *cmd, filter_type filtertype)
 
 static void process_cached_repolist(const char *path);
 
-void repo_config(struct cgit_repo *repo, const char *name, const char *value)
+static void repo_config(struct cgit_repo *repo, const char *name, const char *value)
 {
        struct string_list_item *item;
 
@@ -114,7 +114,7 @@ void repo_config(struct cgit_repo *repo, const char *name, const char *value)
        }
 }
 
-void config_cb(const char *name, const char *value)
+static void config_cb(const char *name, const char *value)
 {
        if (!strcmp(name, "section") || !strcmp(name, "repo.group"))
                ctx.cfg.section = xstrdup(value);
@@ -155,9 +155,7 @@ void config_cb(const char *name, const char *value)
        else if (!strcmp(name, "strict-export"))
                ctx.cfg.strict_export = xstrdup(value);
        else if (!strcmp(name, "virtual-root")) {
-               ctx.cfg.virtual_root = trim_end(value, '/');
-               if (!ctx.cfg.virtual_root && (!strcmp(value, "/")))
-                       ctx.cfg.virtual_root = "";
+               ctx.cfg.virtual_root = ensure_end(value, '/');
        } else if (!strcmp(name, "nocache"))
                ctx.cfg.nocache = atoi(value);
        else if (!strcmp(name, "noplainemail"))
@@ -333,11 +331,6 @@ static void querystring_cb(const char *name, const char *value)
        }
 }
 
-char *xstrdupn(const char *str)
-{
-       return (str ? xstrdup(str) : NULL);
-}
-
 static void prepare_context(struct cgit_context *ctx)
 {
        memset(ctx, 0, sizeof(*ctx));
@@ -382,16 +375,16 @@ static void prepare_context(struct cgit_context *ctx)
        ctx->cfg.summary_tags = 10;
        ctx->cfg.max_atom_items = 10;
        ctx->cfg.ssdiff = 0;
-       ctx->env.cgit_config = xstrdupn(getenv("CGIT_CONFIG"));
-       ctx->env.http_host = xstrdupn(getenv("HTTP_HOST"));
-       ctx->env.https = xstrdupn(getenv("HTTPS"));
-       ctx->env.no_http = xstrdupn(getenv("NO_HTTP"));
-       ctx->env.path_info = xstrdupn(getenv("PATH_INFO"));
-       ctx->env.query_string = xstrdupn(getenv("QUERY_STRING"));
-       ctx->env.request_method = xstrdupn(getenv("REQUEST_METHOD"));
-       ctx->env.script_name = xstrdupn(getenv("SCRIPT_NAME"));
-       ctx->env.server_name = xstrdupn(getenv("SERVER_NAME"));
-       ctx->env.server_port = xstrdupn(getenv("SERVER_PORT"));
+       ctx->env.cgit_config = getenv("CGIT_CONFIG");
+       ctx->env.http_host = getenv("HTTP_HOST");
+       ctx->env.https = getenv("HTTPS");
+       ctx->env.no_http = getenv("NO_HTTP");
+       ctx->env.path_info = getenv("PATH_INFO");
+       ctx->env.query_string = getenv("QUERY_STRING");
+       ctx->env.request_method = getenv("REQUEST_METHOD");
+       ctx->env.script_name = getenv("SCRIPT_NAME");
+       ctx->env.server_name = getenv("SERVER_NAME");
+       ctx->env.server_port = getenv("SERVER_PORT");
        ctx->page.mimetype = "text/html";
        ctx->page.charset = PAGE_ENCODING;
        ctx->page.filename = NULL;
@@ -401,9 +394,9 @@ static void prepare_context(struct cgit_context *ctx)
        ctx->page.etag = NULL;
        memset(&ctx->cfg.mimetypes, 0, sizeof(struct string_list));
        if (ctx->env.script_name)
-               ctx->cfg.script_name = ctx->env.script_name;
+               ctx->cfg.script_name = xstrdup(ctx->env.script_name);
        if (ctx->env.query_string)
-               ctx->qry.raw = ctx->env.query_string;
+               ctx->qry.raw = xstrdup(ctx->env.query_string);
        if (!ctx->env.cgit_config)
                ctx->env.cgit_config = CGIT_CONFIG;
 }
@@ -414,8 +407,8 @@ struct refmatch {
        int match;
 };
 
-int find_current_ref(const char *refname, const unsigned char *sha1,
-                    int flags, void *cb_data)
+static int find_current_ref(const char *refname, const unsigned char *sha1,
+                           int flags, void *cb_data)
 {
        struct refmatch *info;
 
@@ -427,7 +420,13 @@ int find_current_ref(const char *refname, const unsigned char *sha1,
        return info->match;
 }
 
-char *find_default_branch(struct cgit_repo *repo)
+static void free_refmatch_inner(struct refmatch *info)
+{
+       if (info->first_ref)
+               free(info->first_ref);
+}
+
+static char *find_default_branch(struct cgit_repo *repo)
 {
        struct refmatch info;
        char *ref;
@@ -442,10 +441,12 @@ char *find_default_branch(struct cgit_repo *repo)
                ref = info.first_ref;
        if (ref)
                ref = xstrdup(ref);
+       free_refmatch_inner(&info);
+
        return ref;
 }
 
-static char *guess_defbranch(const char *repo_path)
+static char *guess_defbranch(void)
 {
        const char *ref;
        unsigned char sha1[20];
@@ -483,7 +484,7 @@ static int prepare_repo_cmd(struct cgit_context *ctx)
        ctx->page.title = fmt("%s - %s", ctx->repo->name, ctx->repo->desc);
 
        if (!ctx->repo->defbranch)
-               ctx->repo->defbranch = guess_defbranch(ctx->repo->path);
+               ctx->repo->defbranch = guess_defbranch();
 
        if (!ctx->qry.head) {
                ctx->qry.nohead = 1;
@@ -569,13 +570,13 @@ static void process_request(void *cbdata)
                cgit_print_docend();
 }
 
-int cmp_repos(const void *a, const void *b)
+static int cmp_repos(const void *a, const void *b)
 {
        const struct cgit_repo *ra = a, *rb = b;
        return strcmp(ra->url, rb->url);
 }
 
-char *build_snapshot_setting(int bitmap)
+static char *build_snapshot_setting(int bitmap)
 {
        const struct cgit_snapshot_format *f;
        char *result = xstrdup("");
@@ -595,7 +596,7 @@ char *build_snapshot_setting(int bitmap)
        return result;
 }
 
-char *get_first_line(char *txt)
+static char *get_first_line(char *txt)
 {
        char *t = xstrdup(txt);
        char *p = strchr(t, '\n');
@@ -604,7 +605,7 @@ char *get_first_line(char *txt)
        return t;
 }
 
-void print_repo(FILE *f, struct cgit_repo *repo)
+static void print_repo(FILE *f, struct cgit_repo *repo)
 {
        fprintf(f, "repo.url=%s\n", repo->url);
        fprintf(f, "repo.name=%s\n", repo->name);
@@ -649,7 +650,7 @@ void print_repo(FILE *f, struct cgit_repo *repo)
        fprintf(f, "\n");
 }
 
-void print_repolist(FILE *f, struct cgit_repolist *list, int start)
+static void print_repolist(FILE *f, struct cgit_repolist *list, int start)
 {
        int i;
 
@@ -830,11 +831,8 @@ int main(int argc, const char **argv)
         * that virtual-root equals SCRIPT_NAME, minus any possibly
         * trailing slashes.
         */
-       if (!ctx.cfg.virtual_root && ctx.cfg.script_name) {
-               ctx.cfg.virtual_root = trim_end(ctx.cfg.script_name, '/');
-               if (!ctx.cfg.virtual_root)
-                       ctx.cfg.virtual_root = "";
-       }
+       if (!ctx.cfg.virtual_root && ctx.cfg.script_name)
+               ctx.cfg.virtual_root = ensure_end(ctx.cfg.script_name, '/');
 
        /* If no url parameter is specified on the querystring, lets
         * use PATH_INFO as url. This allows cgit to work with virtual