[PATCH] merge: fix out-of-bounds memory access
- From
René Scharfe <rene.scharfe@lsrfire.ath.cx>
- Date
- Jan 31, 2009, 14:39 UTC
- Message-ID
- <4984628E.8090600@lsrfire.ath.cx>
- In-Reply-To
- <20090129120539.GA26975@elte.hu>
The following on top of master lets git finish the merge without segfault (reporting a merge conflict) and valgrind doesn't find an more memory errors here. Can you confirm that, Ingo?
-- 8< -- The parameter n of unpack_callback() can have a value of up to MAX_UNPACK_TREES. The check at the top of unpack_trees() (its only (indirect) caller) makes sure it cannot exceed this limit.
unpack_callback() passes it and the array src to unpack_nondirectories(), which has this loop:
for (i = 0; i < n; i++) {
/* ... */
src[i + o->merge] = o->df_conflict_entry;o->merge can be 0 or 1, so unpack_nondirectories() potentially accesses the array src at index MAX_UNPACK_TREES. This patch makes it big enough.
Reported-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: Rene Scharfe <rene.scharfe@lsrfire.ath.cx> --- unpack-trees.c | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/unpack-trees.c b/unpack-trees.c index 16bc2ca..e547282 100644 --- a/unpack-trees.c +++ b/unpack-trees.c @@ -240,8 +240,11 @@ static struct cache_entry *create_ce_entry(const struct traverse_info *info, con return ce; } -static int unpack_nondirectories(int n, unsigned long mask, unsigned long dirmask, struct cache_entry *src[5], - const struct name_entry *names, const struct traverse_info *info) +static int unpack_nondirectories(int n, unsigned long mask, + unsigned long dirmask, + struct cache_entry **src, + const struct name_entry *names, + const struct traverse_info *info) { int i; struct unpack_trees_options *o = info->data; @@ -291,7 +294,7 @@ static int unpack_nondirectories(int n, unsigned long mask, unsigned long dirmas static int unpack_callback(int n, unsigned long mask, unsigned long dirmask, struct name_entry *names, struct traverse_info *info) { - struct cache_entry *src[5] = { NULL, }; + struct cache_entry *src[MAX_UNPACK_TREES + 1] = { NULL, }; struct unpack_trees_options *o = info->data; const struct name_entry *p = names;
-- 1.6.1