Merge branch 'bc/commit-invalid-utf8'

Logic to auto-detect character encodings in the commit log message
did not reject overlong and invalid UTF-8 characters.

* bc/commit-invalid-utf8:
commit: reject non-characters
commit: reject overlong UTF-8 sequences
commit: reject invalid UTF-8 codepoints

diff --git a/commit.c b/commit.c
index ebc0eeab8f9c1678f3780991a9414f2261215427..e5862f6d7c813b4bcc5dd672383e56152ceb6f80 100644 (file)
--- a/commit.c
+++ b/commit.c
@@ -1350,10 +1350,15 @@ int commit_tree(const struct strbuf *msg, unsigned char *tree,
 static int find_invalid_utf8(const char *buf, int len)
 {
        int offset = 0;
+       static const unsigned int max_codepoint[] = {
+               0x7f, 0x7ff, 0xffff, 0x10ffff
+       };
 
        while (len) {
                unsigned char c = *buf++;
                int bytes, bad_offset;
+               unsigned int codepoint;
+               unsigned int min_val, max_val;
 
                len--;
                offset++;
@@ -1374,24 +1379,48 @@ static int find_invalid_utf8(const char *buf, int len)
                        bytes++;
                }
 
-               /* Must be between 1 and 5 more bytes */
-               if (bytes < 1 || bytes > 5)
+               /*
+                * Must be between 1 and 3 more bytes.  Longer sequences result in
+                * codepoints beyond U+10FFFF, which are guaranteed never to exist.
+                */
+               if (bytes < 1 || 3 < bytes)
                        return bad_offset;
 
                /* Do we *have* that many bytes? */
                if (len < bytes)
                        return bad_offset;
 
+               /*
+                * Place the encoded bits at the bottom of the value and compute the
+                * valid range.
+                */
+               codepoint = (c & 0x7f) >> bytes;
+               min_val = max_codepoint[bytes-1] + 1;
+               max_val = max_codepoint[bytes];
+
                offset += bytes;
                len -= bytes;
 
                /* And verify that they are good continuation bytes */
                do {
+                       codepoint <<= 6;
+                       codepoint |= *buf & 0x3f;
                        if ((*buf++ & 0xc0) != 0x80)
                                return bad_offset;
                } while (--bytes);
 
-               /* We could/should check the value and length here too */
+               /* Reject codepoints that are out of range for the sequence length. */
+               if (codepoint < min_val || codepoint > max_val)
+                       return bad_offset;
+               /* Surrogates are only for UTF-16 and cannot be encoded in UTF-8. */
+               if ((codepoint & 0x1ff800) == 0xd800)
+                       return bad_offset;
+               /* U+xxFFFE and U+xxFFFF are guaranteed non-characters. */
+               if ((codepoint & 0xffffe) == 0xfffe)
+                       return bad_offset;
+               /* So are anything in the range U+FDD0..U+FDEF. */
+               if (codepoint >= 0xfdd0 && codepoint <= 0xfdef)
+                       return bad_offset;
        }
        return -1;
 }
@@ -1401,9 +1430,6 @@ static int find_invalid_utf8(const char *buf, int len)
  *
  * If it isn't, it assumes any non-utf8 characters are Latin1,
  * and does the conversion.
- *
- * Fixme: we should probably also disallow overlong forms and
- * invalid characters. But we don't do that currently.
  */
 static int verify_utf8(struct strbuf *buf)
 {

diff --git a/t/t3900-i18n-commit.sh b/t/t3900-i18n-commit.sh
index 37ddabba2d60956a4d8da63585bec5a622e12a5d..38b00c37b0606a5442f2dce02647a019f0c80c9e 100755 (executable)
--- a/t/t3900-i18n-commit.sh
+++ b/t/t3900-i18n-commit.sh
@@ -39,6 +39,42 @@ test_expect_failure 'UTF-16 refused because of NULs' '
        git commit -a -F "$TEST_DIRECTORY"/t3900/UTF-16.txt
 '
 
+test_expect_success 'UTF-8 invalid characters refused' '
+       test_when_finished "rm -f $HOME/stderr $HOME/invalid" &&
+       echo "UTF-8 characters" >F &&
+       printf "Commit message\n\nInvalid surrogate:\355\240\200\n" \
+               >"$HOME/invalid" &&
+       git commit -a -F "$HOME/invalid" 2>"$HOME"/stderr &&
+       grep "did not conform" "$HOME"/stderr
+'
+
+test_expect_success 'UTF-8 overlong sequences rejected' '
+       test_when_finished "rm -f $HOME/stderr $HOME/invalid" &&
+       rm -f "$HOME/stderr" "$HOME/invalid" &&
+       echo "UTF-8 overlong" >F &&
+       printf "\340\202\251ommit message\n\nThis is not a space:\300\240\n" \
+               >"$HOME/invalid" &&
+       git commit -a -F "$HOME/invalid" 2>"$HOME"/stderr &&
+       grep "did not conform" "$HOME"/stderr
+'
+
+test_expect_success 'UTF-8 non-characters refused' '
+       test_when_finished "rm -f $HOME/stderr $HOME/invalid" &&
+       echo "UTF-8 non-character 1" >F &&
+       printf "Commit message\n\nNon-character:\364\217\277\276\n" \
+               >"$HOME/invalid" &&
+       git commit -a -F "$HOME/invalid" 2>"$HOME"/stderr &&
+       grep "did not conform" "$HOME"/stderr
+'
+
+test_expect_success 'UTF-8 non-characters refused' '
+       test_when_finished "rm -f $HOME/stderr $HOME/invalid" &&
+       echo "UTF-8 non-character 2." >F &&
+       printf "Commit message\n\nNon-character:\357\267\220\n" \
+               >"$HOME/invalid" &&
+       git commit -a -F "$HOME/invalid" 2>"$HOME"/stderr &&
+       grep "did not conform" "$HOME"/stderr
+'
 
 for H in ISO8859-1 eucJP ISO-2022-JP
 do