[PATCH] wt-status: use strncmp() for length-limited string comparison
- From
René Scharfe <l.s.r@web.de>
- Date
- Nov 6, 2015, 22:47 UTC
- Message-ID
- <563D2DE7.1030005@web.de>
When a branch name is longer than four characters, memcmp() can read past the end of the string literal "HEAD". Use strncmp() instead, which stops at the end of a string. This fixes the following test failures with AddressSanitizer:
t3203-branch-output.sh (Wstat: 256 Tests: 18 Failed: 4) Failed tests: 12, 15-17 Non-zero exit status: 1 t3412-rebase-root.sh (Wstat: 256 Tests: 31 Failed: 3) Failed tests: 28-29, 31 Non-zero exit status: 1 t3507-cherry-pick-conflict.sh (Wstat: 256 Tests: 31 Failed: 4) Failed tests: 14, 29-31 Non-zero exit status: 1 t3510-cherry-pick-sequence.sh (Wstat: 256 Tests: 39 Failed: 14) Failed tests: 17, 22-26, 28-30, 34-35, 37-39 Non-zero exit status: 1 t3420-rebase-autostash.sh (Wstat: 256 Tests: 28 Failed: 4) Failed tests: 24-27 Non-zero exit status: 1 t3404-rebase-interactive.sh (Wstat: 256 Tests: 91 Failed: 57) Failed tests: 17, 19, 21-42, 44, 46-74, 77, 81-82 Non-zero exit status: 1 t3900-i18n-commit.sh (Wstat: 256 Tests: 34 Failed: 1) Failed test: 34 Non-zero exit status: 1 t5407-post-rewrite-hook.sh (Wstat: 256 Tests: 14 Failed: 6) Failed tests: 9-14 Non-zero exit status: 1 t7001-mv.sh (Wstat: 256 Tests: 46 Failed: 5) Failed tests: 39-43 Non-zero exit status: 1 t7509-commit.sh (Wstat: 256 Tests: 12 Failed: 2) Failed tests: 11-12 Non-zero exit status: 1 t7512-status-help.sh (Wstat: 256 Tests: 39 Failed: 35) Failed tests: 5-39 Non-zero exit status: 1 t6030-bisect-porcelain.sh (Wstat: 256 Tests: 70 Failed: 1) Failed test: 13 Non-zero exit status: 1
Signed-off-by: Rene Scharfe <l.s.r@web.de> --- wt-status.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/wt-status.c b/wt-status.c index 435fc28..8dc281b 100644 --- a/wt-status.c +++ b/wt-status.c @@ -1319,7 +1319,7 @@ static int grab_1st_switch(unsigned char *osha1, unsigned char *nsha1, hashcpy(cb->nsha1, nsha1); for (end = target; *end && *end != '\n'; end++) ; - if (!memcmp(target, "HEAD", end - target)) { + if (!strncmp(target, "HEAD", end - target)) { /* HEAD is relative. Resolve it to the right reflog entry. */ strbuf_addstr(&cb->buf, find_unique_abbrev(nsha1, DEFAULT_ABBREV));
-- 2.6.3