From mboxrd@z Thu Jan 1 00:00:00 1970 From: john at keeping.me.uk (John Keeping) Date: Sun, 19 Feb 2017 12:44:58 +0000 Subject: [PATCH 0/3] Fix segfault found by AFL Message-ID: I set AFL [0] loose on CGit's URL input yesterday and it managed to find one issue that leads to a segfault via a null dereference. Either of the first or third patches fixes the segfault, but I much prefer the first as a solid fix, the third is a bit too subtle as a way to ensure that the necessary invariant holds. The second patch also fixes the route that AFL found, but it's possible to get the same effect using broken out query parameters like "?p=log&path=foo" but I'm including it because it seems to make sense to use the value of the final "url" parameter we receive fully rather than some combination of that and a previous URL. [0] http://lcamtuf.coredump.cx/afl/ John Keeping (3): ui-shared: don't print path crumbs without a repo parsing: clear query path before starting cgit: don't set vpath unless repo is set cgit.c | 12 ++++++------ parsing.c | 2 +- ui-shared.c | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) -- 2.12.0.rc2.230.ga28edc07cd