From: Junio C Hamano Date: Fri, 16 Jan 2015 19:58:55 GMT Subject: Re: Segmentation fault in git apply Message-ID: In-Reply-To: <4157F6B0-DDF4-4F71-A09B-EE216537CA89@gmail.com> "Kyle J. McKay" writes: > If I make this change on top of 250b3c6c: > > diff --git a/builtin/apply.c b/builtin/apply.c > index df773c75..8795e830 100644 > --- a/builtin/apply.c > +++ b/builtin/apply.c > @@ -2390,6 +2390,8 @@ static int match_fragment(struct image *img, > fixed_buf = strbuf_detach(&fixed, &fixed_len); > if (postlen < postimage->len) > postlen = 0; > + if (postlen) > + postlen = 2 * postimage->len; > update_pre_post_images(preimage, postimage, > fixed_buf, fixed_len, postlen); > return 1; > > Then the problem goes away. That seems to suggest that postlen is > being computed incorrectly, but someone more familiar with > bulitin/apply.c is going to need to look at it. Indeed, with this, the test case detects under-counting in the caller (the caller counts 262 bytes but the expansion consumes 273 bytes). -- >8 -- Subject: apply: make update_pre_post_images() sanity check the given postlen --- builtin/apply.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/builtin/apply.c b/builtin/apply.c index 622ee16..18b7997 100644 --- a/builtin/apply.c +++ b/builtin/apply.c @@ -2174,6 +2174,10 @@ static void update_pre_post_images(struct image *preimage, /* Fix the length of the whole thing */ postimage->len = new - postimage->buf; postimage->nr -= reduced; + + if (postlen && postlen < (new - postimage->buf)) + die("BUG: postlen = %d, used = %d", + (int)postlen, (int)(new - postimage->buf)); } static int match_fragment(struct image *img, -- 2.3.0-rc0-149-g0286818