git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Segmentation fault in git read-tree

From
Junio C Hamano <gitster@pobox.com>
Date
Mar 14, 2008, 05:07 UTC
Message-ID
<7vskytuc55.fsf@gitster.siamese.dyndns.org>
In-Reply-To
<7vejadvrk7.fsf@gitster.siamese.dyndns.org>
Thanks for the fix.
Let's do this right, as the two limits should be in sync.

-- >8 -- read-tree() and unpack_trees(): use consistent limit

read-tree -m can read up to MAX_TREES, which was arbitrarily set to 8 since August 2007 (4 is needed to deal with 2 merge-base case).

However, the updated unpack_trees() code had an advertised limit of 4 (which it enforced). In reality the code was prepared to take only 3 trees and giving 4 caused it to stomp on its stack. Rename the MAX_TREES constant to MAX_UNPACK_TREES, move it to the unpack-trees.h common header file, and use it from both places to avoid future confusion.

Bug-reintroduced-and-fixed-by: Linus Torvalds <torvalds@linux-foundation.org>
Patch-munged-and-tested-by: Junio C Hamano <gitster@pobox.com>
---
 builtin-read-tree.c |    9 ++++-----
 unpack-trees.c      |    6 +++---
 unpack-trees.h      |    2 ++
 3 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/builtin-read-tree.c b/builtin-read-tree.c
index 160456d..e9cfd2b 100644
--- a/builtin-read-tree.c
+++ b/builtin-read-tree.c
@@ -13,16 +13,15 @@
 #include "dir.h"
 #include "builtin.h"
 
-#define MAX_TREES 8
 static int nr_trees;
-static struct tree *trees[MAX_TREES];
+static struct tree *trees[MAX_UNPACK_TREES];
 
 static int list_tree(unsigned char *sha1)
 {
 	struct tree *tree;
 
-	if (nr_trees >= MAX_TREES)
-		die("I cannot read more than %d trees", MAX_TREES);
+	if (nr_trees >= MAX_UNPACK_TREES)
+		die("I cannot read more than %d trees", MAX_UNPACK_TREES);
 	tree = parse_tree_indirect(sha1);
 	if (!tree)
 		return -1;
@@ -97,7 +96,7 @@ int cmd_read_tree(int argc, const char **argv, const char *unused_prefix)
 {
 	int i, newfd, stage = 0;
 	unsigned char sha1[20];
-	struct tree_desc t[MAX_TREES];
+	struct tree_desc t[MAX_UNPACK_TREES];
 	struct unpack_trees_options opts;
 
 	memset(&opts, 0, sizeof(opts));
diff --git a/unpack-trees.c b/unpack-trees.c
index be89d52..91649f3 100644
--- a/unpack-trees.c
+++ b/unpack-trees.c
@@ -123,7 +123,7 @@ static int unpack_index_entry(struct cache_entry *ce, struct unpack_trees_option
 int traverse_trees_recursive(int n, unsigned long dirmask, unsigned long df_conflicts, struct name_entry *names, struct traverse_info *info)
 {
 	int i;
-	struct tree_desc t[3];
+	struct tree_desc t[MAX_UNPACK_TREES];
 	struct traverse_info newinfo;
 	struct name_entry *p;
 
@@ -327,8 +327,8 @@ int unpack_trees(unsigned len, struct tree_desc *t, struct unpack_trees_options
 {
 	static struct cache_entry *dfc;
 
-	if (len > 4)
-		die("unpack_trees takes at most four trees");
+	if (len > MAX_UNPACK_TREES)
+		die("unpack_trees takes at most %d trees", MAX_UNPACK_TREES);
 	memset(&state, 0, sizeof(state));
 	state.base_dir = "";
 	state.force = 1;
diff --git a/unpack-trees.h b/unpack-trees.h
index e8abbcd..50453ed 100644
--- a/unpack-trees.h
+++ b/unpack-trees.h
@@ -1,6 +1,8 @@
 #ifndef UNPACK_TREES_H
 #define UNPACK_TREES_H
 
+#define MAX_UNPACK_TREES 8
+
 struct unpack_trees_options;
 
 typedef int (*merge_fn_t)(struct cache_entry **src,
Previous: Junio C HamanoNext: Len Brown
Message 7 of 9 in “Segmentation fault git read-tree”
  1. Len BrownMar 14, 2008
  2. Linus TorvaldsMar 14, 2008
  3. Linus TorvaldsMar 14, 2008
  4. Linus TorvaldsMar 14, 2008
  5. Junio C HamanoMar 14, 2008
  6. Junio C HamanoMar 14, 2008
  7. Junio C HamanoMar 14, 2008
  8. Len BrownMar 14, 2008
  9. Linus TorvaldsMar 14, 2008

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.