threads / patch / 37033

patchsha1_file: avoid overrunning alternate object base string

Subject: [PATCH] sha1_file: avoid overrunning alternate object base string

## tl;dr

One message between Jul 1, 2014 and Jul 1, 2014. Diffs are folded; open one to read it.

replies: 0people: 1as markdown or json

René Scharfe· Jul 1, 2014, 18:00 UTC · lore

While checking if a new alternate object database is a duplicate make sure that old and new base paths have the same length before comparing them with memcmp. This avoids overrunning the buffer of the existing entry if the new one is longer and it stops rejecting foobar/ after foo/ was already added.

Signed-off-by: Rene Scharfe <ls.r@web.de>
---
 sha1_file.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
Show changes to sha1_file.c +2 −1
diff --git a/sha1_file.c b/sha1_file.c
index 8adab14..b7ad6c1 100644
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -315,7 +315,8 @@ static int link_alt_odb_entry(const char *entry, const char *relative_base, int
 	 * thing twice, or object directory itself.
 	 */
 	for (alt = alt_odb_list; alt; alt = alt->next) {
-		if (!memcmp(ent->base, alt->base, pfxlen)) {
+		if (pfxlen == alt->name - alt->base - 1 &&
+		    !memcmp(ent->base, alt->base, pfxlen)) {
 			free(ent);
 			return -1;
 		}
-- 
2.0.0

← back to recent threads