Re: [PATCH v2 08/10] object.c: don't go past "len" under die() in type_from_string_gently()
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Apr 29, 2021, 04:55 UTC
- Message-ID
- <xmqq1rat8zbh.fsf@gitster.g>
- In-Reply-To
- <patch-08.10-f652d0fb5c-20210420T124428Z-avarab@gmail.com>
Ævar Arnfjörð Bjarmason <avarab@gmail.com> writes:
Show 13 quoted lines
> Fix a bug that's been with us ever since type_from_string_gently() was > split off from type_from_string() in fe8e3b71805 (Refactor > type_from_string() to allow continuing after detecting an error, > 2014-09-10). > > When the type was invalid and we were in the non-gently mode we'd die, > and then proceed to run off past the "len" of the buffer we were > provided with. > > Luckily, I think that nothing ever used this function in that way. Any > non-gentle invocation came via type_from_string(), which was passing a > buffer with a NIL at the same place as the "len" would take us (we got > it via strlen()).
NIL???
Show 17 quoted lines
>
> Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
> ---
> object.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/object.c b/object.c
> index 70af833ca1..bad9e17f25 100644
> --- a/object.c
> +++ b/object.c
> @@ -50,7 +50,7 @@ int type_from_string_gently(const char *str, ssize_t len, int gentle)
> if (gentle)
> return -1;
>
> - die(_("invalid object type \"%s\""), str);
> + die(_("invalid object type \"%.*s\""), (int)len, str);
> }This makes total sense. This is one of the reasons why I hate to review your topics---many patches in them seem unwarranted churn, but there are clear gems like this commit buried in late steps in them so I need to read through them to find these anyway :-)