{"thread":{"id":"12046","subject":"[PATCH] apply: fix segfault","startedAt":"2008-02-11T22:28:25Z","lastAt":"2008-02-11T23:48:27Z","messageCount":4,"participants":["Johannes Schindelin","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"68456","messageId":"alpine.LSU.1.00.0802112227400.3870@racer.site","threadId":"12046","inReplyTo":null,"subject":"[PATCH] apply: fix segfault","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2008-02-11T22:28:25Z","receivedAt":"2008-02-11T22:28:25Z","isPatch":true,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"\nWhen the patch reports a line number that is larger than the number of\nlines in the current version of the file, git-apply used to segfault.\n\nThis fixes it.\n\nSigned-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>\n---\n\n\tThis just happened to me.\n\n builtin-apply.c |    2 +-\n 1 files changed, 1 insertions(+), 1 deletions(-)\n\ndiff --git a/builtin-apply.c b/builtin-apply.c\nindex 4578542..ca7096f 100644\n--- a/builtin-apply.c\n+++ b/builtin-apply.c\n@@ -1830,7 +1830,7 @@ static int find_pos(struct image *img,\n \t\t\treturn try_lno;\n \n \tagain:\n-\t\tif (backwards_lno == 0 && forwards_lno == img->nr)\n+\t\tif (backwards_lno == 0 && forwards_lno >= img->nr)\n \t\t\tbreak;\n \n \t\tif (i & 1) {\n-- \n1.5.4.1264.gb53928\n"},{"id":"68459","messageId":"7vprv36qkt.fsf@gitster.siamese.dyndns.org","threadId":"12046","inReplyTo":"alpine.LSU.1.00.0802112227400.3870@racer.site","subject":"Re: [PATCH] apply: fix segfault","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-02-11T23:06:26Z","receivedAt":"2008-02-11T23:06:26Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:\n\n> When the patch reports a line number that is larger than the number of\n> lines in the current version of the file, git-apply used to segfault.\n\nI have to wonder if the correct fix should be like this\ninstead.  Under that condition, I think computation of the\ninitial \"try\" value already oversteps the line[] array for the\noriginal image.\n\ndiff --git a/builtin-apply.c b/builtin-apply.c\nindex 2b8ba81..177f541 100644\n--- a/builtin-apply.c\n+++ b/builtin-apply.c\n@@ -1809,6 +1809,9 @@ static int find_pos(struct image *img,\n \telse if (match_end)\n \t\tline = img->nr - preimage->nr;\n \n+\tif (line > preimage->nr)\n+\t\tline = preimage->nr;\n+\n \ttry = 0;\n \tfor (i = 0; i < line; i++)\n \t\ttry += img->line[i].len;\n"},{"id":"68462","messageId":"7vir0v6pjm.fsf@gitster.siamese.dyndns.org","threadId":"12046","inReplyTo":"7vprv36qkt.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] apply: fix segfault","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-02-11T23:28:45Z","receivedAt":"2008-02-11T23:28:45Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n> Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:\n>\n>> When the patch reports a line number that is larger than the number of\n>> lines in the current version of the file, git-apply used to segfault.\n>\n> I have to wonder if the correct fix should be like this\n> instead.  Under that condition, I think computation of the\n> initial \"try\" value already oversteps the line[] array for the\n> original image.\n\nWith tests...\n\n builtin-apply.c       |    3 ++\n t/t4105-apply-fuzz.sh |   60 +++++++++++++++++++++++++++++++++++++++++++++++++\n 2 files changed, 63 insertions(+), 0 deletions(-)\n\ndiff --git a/builtin-apply.c b/builtin-apply.c\nindex 2b8ba81..177f541 100644\n--- a/builtin-apply.c\n+++ b/builtin-apply.c\n@@ -1809,6 +1809,9 @@ static int find_pos(struct image *img,\n \telse if (match_end)\n \t\tline = img->nr - preimage->nr;\n \n+\tif (line > preimage->nr)\n+\t\tline = preimage->nr;\n+\n \ttry = 0;\n \tfor (i = 0; i < line; i++)\n \t\ttry += img->line[i].len;\ndiff --git a/t/t4105-apply-fuzz.sh b/t/t4105-apply-fuzz.sh\nnew file mode 100755\nindex 0000000..9c2a9f5\n--- /dev/null\n+++ b/t/t4105-apply-fuzz.sh\n@@ -0,0 +1,60 @@\n+#!/bin/sh\n+\n+test_description='apply with fuzz and offset'\n+\n+. ./test-lib.sh\n+\n+dotest () {\n+\t\n+\tname=\"$1\" && shift &&\n+\n+\ttest_expect_success \"$name\" \"\n+\t\tgit checkout-index -f -q -u file &&\n+\t\tgit apply $* &&\n+\t\tdiff -u expect file\n+\t\"\n+\n+}\n+\n+test_expect_success setup '\n+\n+\tfor i in 1 2 3 4 5 6 7 8 9 10 11 12\n+\tdo\n+\t\techo $i\n+\tdone >file &&\n+\tgit update-index --add file &&\n+\tfor i in 1 2 3 4 5 6 7 a b c d e 8 9 10 11 12\n+\tdo\n+\t\techo $i\n+\tdone >file &&\n+\tcat file >expect &&\n+\tgit diff >O0.diff &&\n+\n+\tsed -e \"s/@@ -5,6 +5,11 @@/@@ -2,6 +2,11 @@/\" >O1.diff O0.diff &&\n+\tsed -e \"s/@@ -5,6 +5,11 @@/@@ -7,6 +7,11 @@/\" >O2.diff O0.diff &&\n+\tsed -e \"s/@@ -5,6 +5,11 @@/@@ -19,6 +19,11 @@/\" >O3.diff O0.diff &&\n+\n+\tsed -e \"s/^ 5/ S/\" >F0.diff O0.diff &&\n+\tsed -e \"s/^ 5/ S/\" >F1.diff O1.diff &&\n+\tsed -e \"s/^ 5/ S/\" >F2.diff O2.diff &&\n+\tsed -e \"s/^ 5/ S/\" >F3.diff O3.diff\n+\n+'\n+\n+dotest 'unmodified patch' O0.diff\n+\n+dotest 'minus offset' O1.diff\n+\n+dotest 'plus offset' O2.diff\n+\n+dotest 'big offset' O3.diff\n+\n+dotest 'fuzz with no offset' -C2 F0.diff\n+\n+dotest 'fuzz with minus offset' -C2 F1.diff\n+\n+dotest 'fuzz with plus offset' -C2 F2.diff\n+\n+dotest 'fuzz with big offset' -C2 F3.diff\n+\n+test_done\n"},{"id":"68464","messageId":"7vejbj6oms.fsf@gitster.siamese.dyndns.org","threadId":"12046","inReplyTo":"7vprv36qkt.fsf@gitster.siamese.dyndns.org","subject":"Re: [PATCH] apply: fix segfault","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-02-11T23:48:27Z","receivedAt":"2008-02-11T23:48:27Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Junio C Hamano <gitster@pobox.com> writes:\n\n> Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:\n>\n>> When the patch reports a line number that is larger than the number of\n>> lines in the current version of the file, git-apply used to segfault.\n>\n> I have to wonder if the correct fix should be like this\n> instead.  Under that condition, I think computation of the\n> initial \"try\" value already oversteps the line[] array for the\n> original image.\n>\n> diff --git a/builtin-apply.c b/builtin-apply.c\n> index 2b8ba81..177f541 100644\n> --- a/builtin-apply.c\n> +++ b/builtin-apply.c\n> @@ -1809,6 +1809,9 @@ static int find_pos(struct image *img,\n>  \telse if (match_end)\n>  \t\tline = img->nr - preimage->nr;\n>  \n> +\tif (line > preimage->nr)\n> +\t\tline = preimage->nr;\n> +\n>  \ttry = 0;\n>  \tfor (i = 0; i < line; i++)\n>  \t\ttry += img->line[i].len;\n\nSorry, obviously the check should be against img->nr not the\npreimage.\n"}]}