Re: [PATCH 5/8] get-repack --max-pack-size: write_object() takes 'limit' arg

From: Nicolas Pitre <nico@cam.org>
Date: Apr 9, 2007, 18:59 UTC
Message-ID: <alpine.LFD.0.98.0704091455100.28181@xanadu.home>
In-Reply-To: <56b7f5510704091151l70cc74b1la82e0c5a67d6885f@mail.gmail.com>

On Mon, 9 Apr 2007, Dana How wrote:

Show 17 quoted lines

> On 4/8/07, Nicolas Pitre <nico@cam.org> wrote:
> > > @@ -448,6 +480,12 @@ static off_t write_object(struct sha1file *f,
> > >                       header[pos] = ofs & 127;
> > >                       while (ofs >>= 7)
> > >                               header[--pos] = 128 | (--ofs & 127);
> > > +                     if ( limit && hdrlen + sizeof(header) - pos +
> > datalen + 20 >= limit ) {
> > > +                             free(out);
> > > +                             free(buf);
> > > +                             return 0;
> > > +                     }
> > > +                     sha1write(f, header, hdrlen);
> > >                       sha1write(f, header + pos, sizeof(header) - pos);
> > 
> > The above looks rather buggy to me.
> 
> OK, can you be more specific?

You're writing the content of the array 'header' twice in a row. Sure the second time it is header + pos but it is still the result of an operation that used to put data into 'header' after the first content was already written out. Right now it looks like the first write might contain clobbered data.

Nicolas