git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array

From
Shawn O. Pearce <spearce@spearce.org>
Date
Sep 14, 2007, 22:59 UTC
Message-ID
<20070914225953.GC16512@spearce.org>

A long time ago Junio added this line to always ensure that the output array created by remove_duplicates() had a NULL as its terminating node. Today none of the downstream consumers of this array care about a NULL terminator; they only pay attention to the size of the array (as indicated by nr_heads). In (nearly?) all cases passing a NULL element will cause SIGSEGV failures. So this NULL terminal is not actually necessary.

Unfortunately we cannot continue to NULL terminate the array at this point as the array may only have been allocated large enough to match the input of nr_heads. If there are no duplicates than we would be trying to store NULL into heads[nr_heads] and that may be outside of the array.

My recent series to cleanup builtin-fetch changed the allocation of the heads array from 256 entries to exactly nr_heads thus ensuring we were always overstepping the array and causing memory corruption.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
---
 *** RESEND TO CORRECT FROM+SBO ***
 Sorry Junio.  I realized too late that the headers were wrong.
 That's what I get for not configuring ~/.gitconfig on my amd64
 Linux box.  ;-)
 builtin-fetch-pack.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)
diff --git a/builtin-fetch-pack.c b/builtin-fetch-pack.c
index b0936cc..2977a94 100644
--- a/builtin-fetch-pack.c
+++ b/builtin-fetch-pack.c
@@ -654,7 +654,6 @@ static int remove_duplicates(int nr_heads, char **heads)
 			heads[dst] = heads[src];
 		dst++;
 	}
-	heads[dst] = 0;
 	return dst;
 }
 
-- 
1.5.3.1.921.g8c3b
Next: Shawn O. Pearce
Message 1 of 3 in “Fix builtin-fetch memory corruption by not overstepping array”
  1. 1/2 Fix builtin-fetch memory corruption by not overstepping arrayShawn O. Pearce, Sep 14, 2007
  2. Shawn O. PearceSep 14, 2007
  3. Junio C HamanoSep 14, 2007

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.