Re: [PATCH] sha1_name: fix segfault caused by invalid index access

From: Junio C Hamano <gitster@pobox.com>
Date: Feb 28, 2010, 18:13 UTC
Message-ID: <7vocj9cjp9.fsf@alter.siamese.dyndns.org>
In-Reply-To: <1267375122-13039-1-git-send-email-Matthieu.Moy@imag.fr>

Matthieu Moy <Matthieu.Moy@imag.fr> writes:

Show 7 quoted lines

> -	if (pos < 0)
> -		pos = -pos - 1;
> -	ce = active_cache[pos];
> -	if (ce_namelen(ce) == namelen &&
> -	    !memcmp(ce->name, filename, namelen))
> +	if (pos >= 0) {
> +		ce = active_cache[pos];

A positive return value of cache_name_pos() is "I found a merged entry with that name at this index" while a negative is "I would insert at this index if you give me a merged entry with that name".

The latter is what the name comparison logic is about. The caller asked for filename, and the return value may point at an existing entry (in which case you do not even need to memcmp(), but it doesn't hurt and simplifies the code). The nagative one with compensation could be pointing at an unrelated entry, or an unmerged entry with filename you asked, which sorts higher than a merged entry with the same name.