Re: [PATCH] Sanitize escape char sequences coming from server

On Thu, Jun 21, 2018 at 08:09:43PM +0200, Pavel Cahyna wrote: > > > + int len = mbstowcs(wcstring, outbuf->buf, outbuf->len); > > > > I don't think mbstowcs() is always going to do the right thing there. > > We're looking at a string that was sent from the remote server. What > > encoding is it i

Re: [PATCH] Sanitize escape char sequences coming from server

Hello, On Thu, Jun 21, 2018 at 01:41:22PM -0400, Jeff King wrote: > On Thu, Jun 21, 2018 at 02:10:30PM +0200, Sebastian Kisela wrote: > > > From: Sebastian Kisela > > + int len = mbstowcs(wcstring, outbuf->buf, outbuf->len); > > I don't think mbstowcs() is always going to do the right thing t

Re: [PATCH] Sanitize escape char sequences coming from server

On Thu, Jun 21, 2018 at 02:10:30PM +0200, Sebastian Kisela wrote: > From: Sebastian Kisela > > Fix volnurability against MITM attacks on client side > by replacing non printable and non white space characters > by "?". > > Fixes: CVE-2018-121 I'm not sure if this is a productive direction

[PATCH] Sanitize escape char sequences coming from server

From: Sebastian Kisela Fix volnurability against MITM attacks on client side by replacing non printable and non white space characters by "?". Fixes: CVE-2018-121 Signed-off-by: Sebastian Kisela --- sideband.c | 20 t/t5401-update-hooks.sh | 23 +++