[PATCH] sha1_name: fix segfault caused by invalid index access
- From
Matthieu Moy <matthieu.moy@imag.fr>
- Date
- Feb 28, 2010, 16:38 UTC
- Message-ID
- <1267375122-13039-1-git-send-email-Matthieu.Moy@imag.fr>
- In-Reply-To
- <vpq7hpxl4cp.fsf@bauges.imag.fr>
009fee477 (Detailed diagnosis when parsing an object name fails, 2009-12-07) introduced some invalid index access, inspired by the code of get_sha1_with_mode_1, which loops over the index entries having the same name. In the diagnosis, we just want to find whether one entry with the name is in the index, which is the case iff cache_name_pos's return value is positive.
Trying anything complex on negative value is not only useless, but also buggy here, since pos could end up being greater than active_nr, causing a segfault in active_cache[pos]. This is always the case in bare repositories, and happens when calling "git show :inexistant" if "inexistant" is greater than the last index entry in alphabetical order.
Bug report and initial fix by Markus Heidelberg <markus.heidelberg@web.de>.
Signed-off-by: Matthieu Moy <Matthieu.Moy@imag.fr> --- sha1_name.c | 16 ++++++---------- 1 files changed, 6 insertions(+), 10 deletions(-)
diff --git a/sha1_name.c b/sha1_name.c index 43884c6..fbbe3b4 100644 --- a/sha1_name.c +++ b/sha1_name.c @@ -990,15 +990,13 @@ static void diagnose_invalid_index_path(int stage, /* Wrong stage number? */ pos = cache_name_pos(filename, namelen); - if (pos < 0) - pos = -pos - 1; - ce = active_cache[pos]; - if (ce_namelen(ce) == namelen && - !memcmp(ce->name, filename, namelen)) + if (pos >= 0) { + ce = active_cache[pos]; die("Path '%s' is in the index, but not at stage %d.\n" "Did you mean ':%d:%s'?", filename, stage, ce_stage(ce), filename); + } /* Confusion between relative and absolute filenames? */ fullnamelen = namelen + strlen(prefix); @@ -1006,15 +1004,13 @@ static void diagnose_invalid_index_path(int stage, strcpy(fullname, prefix); strcat(fullname, filename); pos = cache_name_pos(fullname, fullnamelen); - if (pos < 0) - pos = -pos - 1; - ce = active_cache[pos]; - if (ce_namelen(ce) == fullnamelen && - !memcmp(ce->name, fullname, fullnamelen)) + if (pos >= 0) { + ce = active_cache[pos]; die("Path '%s' is in the index, but not '%s'.\n" "Did you mean ':%d:%s'?", fullname, filename, ce_stage(ce), fullname); + } if (!lstat(filename, &st)) die("Path '%s' exists on disk, but not in the index.", filename);
-- 1.7.0.231.g97960.dirty