Re: regression in 92392b4
- From
Johannes Schindelin <johannes.schindelin@gmx.de>
- Date
- Jul 23, 2008, 01:20 UTC
- Message-ID
- <alpine.DEB.1.00.0807230219100.8986@racer>
- In-Reply-To
- <20080723010928.GG11831@artemis.madism.org>
Hi,
On Wed, 23 Jul 2008, Pierre Habouzit wrote:
Show 21 quoted lines
> I had a core that I stupidly lost, but I remember that the broken malloc
> was:
>
>
> static void *get_data_from_pack(struct object_entry *obj)
> {
> off_t from = obj[0].idx.offset + obj[0].hdr_size;
> unsigned long len = obj[1].idx.offset - from;
> unsigned long rdy = 0;
> unsigned char *src, *data;
> z_stream stream;
> int st;
>
> src = xmalloc(len);
> ^^^^^^^^^^^^^^^^^^
>
> len was horribly big, and outputing obj[1].idx showed that `sha1` had
> text in it. I mean something like "could not\r\n han" IIRC.
>
> I don't remember the rest of the backtrace, and have stupidly not kept
> any ways of reproducing it.That would not have helped. The memory corruption almost _certainly_ took place way before that.
Ciao, Dscho