{"thread":{"id":"14252","subject":"Suspicious code in builtin-fast-export.c","startedAt":"2008-07-02T09:04:28Z","lastAt":"2008-07-02T09:04:28Z","messageCount":1,"participants":["Johannes Sixt"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"81958","messageId":"486B449C.3050502@viscovery.net","threadId":"14252","inReplyTo":null,"subject":"Suspicious code in builtin-fast-export.c","fromName":"Johannes Sixt","fromEmail":"j.sixt@viscovery.net","sentAt":"2008-07-02T09:04:28Z","receivedAt":"2008-07-02T09:04:28Z","isPatch":false,"sender":{"key":"j6t@kdbg.org","avatar":"https://avatars.githubusercontent.com/u/14810926?v=4"},"body":"export_marks() has this code:\n\n\tstruct object_decoration *deco = idnums.hash;\n...\n\tfor (i = 0; i < idnums.size; ++i) {\n\t\tdeco++;\n\t\tif (deco && deco->base && deco->base->type == 1) {\n...\n\t\t}\n\t}\n\nI see that deco is off by one here at the end of the idnums.hash array\n(and, btw, the check for 'deco &&' is always true). Indeed, this crashes\non Windows, and I can make it crash on Linux with this patch (which\noverallocates a bit and writes junk into that space):\n\ndiff --git a/wrapper.c b/wrapper.c\nindex 4e04f76..658925e 100644\n--- a/wrapper.c\n+++ b/wrapper.c\n@@ -72,7 +72,7 @@ void *xrealloc(void *ptr, size_t size)\n\n void *xcalloc(size_t nmemb, size_t size)\n {\n-\tvoid *ret = calloc(nmemb, size);\n+\tvoid *ret = calloc(nmemb+1, size);\n \tif (!ret && (!nmemb || !size))\n \t\tret = calloc(1, 1);\n \tif (!ret) {\n@@ -83,6 +83,7 @@ void *xcalloc(size_t nmemb, size_t size)\n \t\tif (!ret)\n \t\t\tdie(\"Out of memory, calloc failed\");\n \t}\n+\tmemset(ret+nmemb*size, 0xDE, size);\n \treturn ret;\n }\n\n-- \n1.5.6.64.gd77fe\n"}]}