From: Phillip Wood Date: Wed, 20 Apr 2022 10:04:11 GMT Subject: Re: [PATCH] show-branch: fix SEGFAULT when `--current` and `--reflog` together Message-ID: <0825f153-1d03-feb4-1e34-4aaed766deb0@gmail.com> In-Reply-To: Hi Gregory Thanks for working on this On 19/04/2022 17:32, Gregory David wrote: > If run `show-branch` with `--current` and `--reflog` simultaneously, a > SEGFAULT appears. > > The bug is that we read over the end of the `reflog_msg` array after > having `append_one_rev()` for the current branch without supplying a > convenient message to it. > > It seems that it has been introduced in: > Commit 1aa68d6735 (show-branch: --current includes the current branch., > 2006-01-11) > > Signed-off-by: Gregory DAVID > Thanks-to: Ævar Arnfjörð Bjarmason > --- > builtin/show-branch.c | 20 ++++++++++++++++++++ > 1 file changed, 20 insertions(+) > > diff --git a/builtin/show-branch.c b/builtin/show-branch.c > index e12c5e80e3..892241ce0d 100644 > --- a/builtin/show-branch.c > +++ b/builtin/show-branch.c > @@ -812,6 +812,26 @@ int cmd_show_branch(int ac, const char **av, const > char *prefix) > } > if (!has_head) { > const char *name = head; > + struct object_id oid; > + char *ref; > + unsigned int flags = 0; > + char *log_msg; > + char *end_log_msg; > + timestamp_t timestamp; > + int tz; > + > + if (!dwim_ref(*av, strlen(*av), &oid, &ref, 0)) > + die(_("no such ref %s"), *av); > + if(read_ref_at(get_main_ref_store(the_repository), > + ref, flags, 0, i, &oid, &log_msg, > + ×tamp, &tz, NULL)) { > + end_log_msg = strchr(log_msg, '\n'); > + if (end_log_msg) > + *end_log_msg = '\0'; > + } > + if(log_msg == 0 || *log_msg == '\0') > + log_msg = xstrfmt("(none)"); > + reflog_msg[ref_name_cnt] = xstrfmt("(%s) (current) %s", Do we need a bounds check here? I think we're only guaranteed that ref_name_cnt - 1 < MAX_REVS though I found the existing code a bit hard to follow Best Wishes Phillip > show_date(timestamp, tz, DATE_MODE(RELATIVE)), log_msg); > skip_prefix(name, "refs/heads/", &name); > append_one_rev(name); > }