From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Wed, 26 Oct 2005 14:18:56 GMT
Subject: [PATCH] Fix cloning (memory corruption)
Message-ID: <Pine.LNX.4.63.0510261616550.21073@wbgn013.biozentrum.uni-wuerzburg.de>

upload-pack would set create_full_pack=1 if nr_has==0, but would ask later
if nr_needs<MAX_NEEDS. If that proves true, it would ignore create_full_pack,
and arguments would be written into unreserved memory.

Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>

---

	This patch fixes what can be seen in all beauty when executing

		git-clone . some_dir

	in a repository with lots of branches/tags.

 upload-pack.c |   15 ++++++++-------
 1 files changed, 8 insertions(+), 7 deletions(-)

applies-to: 764f8a201d063a7b49b07daa3a6e48b0af267162
d05392d3ddfa647552190b73505a738330e492b4
diff --git a/upload-pack.c b/upload-pack.c
index 07c1505..878254d 100644
--- a/upload-pack.c
+++ b/upload-pack.c
@@ -60,7 +60,7 @@ static void create_pack_file(void)
 		close(fd[1]);
 		*p++ = "git-rev-list";
 		*p++ = "--objects";
-		if (MAX_NEEDS <= nr_needs)
+		if (create_full_pack || MAX_NEEDS <= nr_needs)
 			*p++ = "--all";
 		else {
 			for (i = 0; i < nr_needs; i++) {
@@ -69,12 +69,13 @@ static void create_pack_file(void)
 				buf += 41;
 			}
 		}
-		for (i = 0; i < nr_has; i++) {
-			*p++ = buf;
-			*buf++ = '^';
-			memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
-			buf += 41;
-		}
+		if (!create_full_pack)
+			for (i = 0; i < nr_has; i++) {
+				*p++ = buf;
+				*buf++ = '^';
+				memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
+				buf += 41;
+			}
 		*p++ = NULL;
 		execvp("git-rev-list", argv);
 		die("git-upload-pack: unable to exec git-rev-list");
---
0.99.8.GIT