{"thread":{"id":"56703","subject":"Possibly wrong assignment in config.c","startedAt":"2021-10-13T17:13:15Z","lastAt":"2021-10-13T19:14:58Z","messageCount":2,"participants":["Andrea Monaco","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"438667","messageId":"87pms8rh2h.fsf@autistici.org","threadId":"56703","inReplyTo":null,"subject":"Possibly wrong assignment in config.c","fromName":"Andrea Monaco","fromEmail":"andrea.monaco@autistici.org","sentAt":"2021-10-13T17:05:26Z","receivedAt":"2021-10-13T17:13:15Z","isPatch":false,"sender":{"key":"andrea.monaco@autistici.org","avatar":null},"body":"\nHello,\n\n\nwhile building git I get the following warning:\n\n\nconfig.c: In function 'git_config_copy_or_rename_section_in_file':\nconfig.c:3358:17: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=]\n 3358 |       output[0] = '\\t';\n      |       ~~~~~~~~~~^~~~~~\nconfig.c:3264:7: note: at offset -1 to object 'buf' with size 1024 declared here\n 3264 |  char buf[1024];\n      |       ^~~\n\n\nconcerning these lines:\n\n  output -= 1;\n  output[0] = '\\t';\n\n\nPerhaps it has some merit.  output is previously equal to an array\nbuf[1024], so the assignment apparently goes outside allocated memory.\n\n\n\nLet me know,\n\nAndrea Monaco\n"},{"id":"438677","messageId":"xmqqzgrcg2j5.fsf@gitster.g","threadId":"56703","inReplyTo":"87pms8rh2h.fsf@autistici.org","subject":"Re: Possibly wrong assignment in config.c","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2021-10-13T19:14:54Z","receivedAt":"2021-10-13T19:14:58Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Andrea Monaco <andrea.monaco@autistici.org> writes:\n\n> config.c: In function 'git_config_copy_or_rename_section_in_file':\n> config.c:3358:17: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=]\n>  3358 |       output[0] = '\\t';\n>       |       ~~~~~~~~~~^~~~~~\n\nHmph, with a wider context, I think the tool is pointing at the\nassignment found here?\n\n\twhile (fgets(buf, sizeof(buf), config_file)) {\n\t\tunsigned i;\n\t\tint length;\n\t\tint is_section = 0;\n\t\tchar *output = buf;\n\t\tfor (i = 0; buf[i] && isspace(buf[i]); i++)\n\t\t\t; /* do nothing */\n\t\tif (buf[i] == '[') {\n\t\t\t/* it's a section */\n\t\t\tint offset;\n\t\t\t...\n\t\t\toffset = section_name_match(&buf[i], old_name);\n\t\t\tif (offset > 0) {\n\t\t\t\t...\n\t\t\t\t\toutput += offset + i;\n\t\t\t\t\tif (strlen(output) > 0) {\n\t\t\t\t\t\t...\n\t\t\t\t\t\toutput -= 1;\n\t\t\t\t\t\toutput[0] = '\\t';\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tcopystr = store_create_section(new_name, &store);\n\t\t\t\t}\n\t\t\t}\n\t\t\tremove = 0;\n\t\t}\n\nInside the \"if (buf[i] == '[')\" block, i is not negative, and inside\nthe \"if (offset > 0)\" block, offset is positive.  So \"output +=\noffset + i\", unless offset and i are so huge to cause integer\nwraparound, would only be incrementing offset by some positive\ninteger.  So immediately after \"output += offset + i\", output is at\nleast buf+1, if not larger, and &output[-1] is at least pointing at\n&buf[0], no?\n\nOr is the tool worried about integer addition (offset+i) wrapping\naround?\n\nOr I may need a bit more caffeine, perhaps?  I am puzzled...\n\nThanks.\n\n\n\n"}]}