{"thread":{"id":"9851","subject":"[PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array","startedAt":"2007-09-14T22:56:13Z","lastAt":"2007-09-14T22:56:13Z","messageCount":1,"participants":["Shawn Pearce"],"isPatch":true,"patchVersion":1,"patchTotal":2},"messages":[{"id":"53078","messageId":"20070914225613.GA16512@spearce.org","threadId":"9851","inReplyTo":null,"subject":"[PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array","fromName":"Shawn Pearce","fromEmail":"spearce@blink.home.spearce.org","sentAt":"2007-09-14T22:56:13Z","receivedAt":"2007-09-14T22:56:13Z","isPatch":true,"sender":{"key":"spearce@blink.home.spearce.org","avatar":null},"body":"A long time ago Junio added this line to always ensure that the\noutput array created by remove_duplicates() had a NULL as its\nterminating node.  Today none of the downstream consumers of this\narray care about a NULL terminator; they only pay attention to the\nsize of the array (as indicated by nr_heads).  In (nearly?) all\ncases passing a NULL element will cause SIGSEGV failures.  So this\nNULL terminal is not actually necessary.\n\nUnfortunately we cannot continue to NULL terminate the array at\nthis point as the array may only have been allocated large enough\nto match the input of nr_heads.  If there are no duplicates than\nwe would be trying to store NULL into heads[nr_heads] and that may\nbe outside of the array.\n\nMy recent series to cleanup builtin-fetch changed the allocation of\nthe heads array from 256 entries to exactly nr_heads thus ensuring\nwe were always overstepping the array and causing memory corruption.\n\nSigned-off-by: Shawn Pearce <spearce@blink.home.spearce.org>\n---\n\n This patch is meant for the top of the db/fetch-pack series\n (currently in pu) but it may actually need to be applied back on\n prior versions (e.g. maint).  The code affected seems to predate\n builtin-fetch by quite a bit and we may just be getting lucky that\n the array is always allocated large enough for this extra entry.\n\n It almost fixes the corruption Junio saw in t3200.  When combined\n with the next patch (2/2) that corruption appears to be fixed on\n both my Mac OS X and my Linux amd64 system.\n\n builtin-fetch-pack.c |    1 -\n 1 files changed, 0 insertions(+), 1 deletions(-)\n\ndiff --git a/builtin-fetch-pack.c b/builtin-fetch-pack.c\nindex b0936cc..2977a94 100644\n--- a/builtin-fetch-pack.c\n+++ b/builtin-fetch-pack.c\n@@ -654,7 +654,6 @@ static int remove_duplicates(int nr_heads, char **heads)\n \t\t\theads[dst] = heads[src];\n \t\tdst++;\n \t}\n-\theads[dst] = 0;\n \treturn dst;\n }\n \n-- \n1.5.3.1.921.g8c3b\n"}]}