Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Bound the cache listing key output
Diffstat (limited to 'source/cache.c')
| -rw-r--r-- | source/cache.c | 11 |
1 file changed, 9 insertions, 2 deletions
diff --git a/source/cache.c b/source/cache.c index 561d9e6..aff0f4d 100644 --- a/source/cache.c +++ b/source/cache.c @@ -425,6 +425,8 @@ int cache_ls(const char *path) struct cache_slot slot = { NULL }; struct strbuf fullname = STRBUF_INIT; size_t prefixlen; + char *nul; + int keylen; if (!path) { cache_log("[cgit] cache path not specified\n"); @@ -451,12 +453,17 @@ int cache_ls(const char *path) fullname.buf, strerror(err), err); continue; } - htmlf("%s %s %10"PRIuMAX" %s\n", + // The stored key is NUL-terminated within the buffer, but a + // truncated or corrupt slot may not be. Bound the print to + // what was read so %s cannot run off the end. + nul = memchr(slot.buf, 0, slot.bufsize); + keylen = nul ? (int)(nul - slot.buf) : slot.bufsize; + htmlf("%s %s %10"PRIuMAX" %.*s\n", fullname.buf, sprintftime("%Y-%m-%d %H:%M:%S", slot.cache_st.st_mtime), (uintmax_t)slot.cache_st.st_size, - slot.buf); + keylen, slot.buf); close_slot(&slot); } closedir(dir); |