{"thread":{"id":"48344","subject":"Re: Fw: New Defects reported by Coverity Scan for git [argv_array: offer to split a string by whitespace]","startedAt":"2018-04-23T11:07:53Z","lastAt":"2018-04-23T11:07:53Z","messageCount":1,"participants":["Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"345452","messageId":"nycvar.QRO.7.76.6.1804231307090.15174@ZVAVAG-6OXH6DA.rhebcr.pbec.zvpebfbsg.pbz","threadId":"48344","inReplyTo":"04F34371EF174E1F8E6E762D1BCA6C4F@PhilipOakley","subject":"Re: Fw: New Defects reported by Coverity Scan for git [argv_array: offer to split a string by whitespace]","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2018-04-23T11:07:32Z","receivedAt":"2018-04-23T11:07:53Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Philip,\n\nOn Sun, 22 Apr 2018, Philip Oakley wrote:\n\n> is this part of your series \"argv_array: offer to split a string by\n> whitespace\"?\n> \n> https://public-inbox.org/git/CAPig+cTDbTtUeFYmkNtM773EBgE14Tpic4g4XEFuSVwSypdMjw@mail.gmail.com/\n> \n> ----- Original Message ----- From: <scan-admin@coverity.com>\n> Sent: Saturday, April 21, 2018 10:53 AM\n> Subject: New Defects reported by Coverity Scan for git\n> \n> > New defect(s) Reported-by: Coverity Scan\n> > Showing 1 of 1 defect(s)\n> >\n> >\n> > ** CID 1434982:  Memory - corruptions  (OVERRUN)\n> >\n> >\n> > ________________________________________________________________________________________________________\n> > *** CID 1434982:  Memory - corruptions  (OVERRUN)\n> > /builtin/replace.c: 475 in convert_graft_file()\n> > 469\n> > 470     while (strbuf_getline(&buf, fp) != EOF) {\n> > 471     if (*buf.buf == '#')\n> > 472     continue;\n> > 473\n> > 474     argv_array_split(&args, buf.buf);\n> > > > >     CID 1434982:  Memory - corruptions  (OVERRUN)\n> > > > >     Overrunning buffer pointed to by \"args.argv\" of 8 bytes by passing\n> > > > > it to a function which accesses it at byte offset 8.\n> > 475     if (args.argc && create_graft(args.argc, args.argv, force))\n> > 476     strbuf_addf(&err, \"\\n\\t%s\", buf.buf);\n> > 477     argv_array_clear(&args);\n> > 478     }\n> > 479\n> > 480     strbuf_release(&buf);\n\nYes, it is. Coverity has problems to figure out what is really happening\nhere, and it has the exact same problems with strbufs.\n\nWe initialize both of these structs using static initializers, with\nspecific, empty arrays. When we need to reallocate, we figure out that the\nempty array was still there and replace it with a NULL so we can realloc.\nSo there is no buffer overrun, but Coverity cannot figure that out, and as\nmuch as I tried, I could not come up with a \"template\" to shut up\nCoverity.\n\nCiao,\nDscho\n"}]}