Skip to content

Commit

Permalink
sha1_name: fix segfault caused by invalid index access
Browse files Browse the repository at this point in the history
The code to see if user input "git show :path" makes sense tried to access
the index without properly checking the array bound.

Signed-off-by: Markus Heidelberg <markus.heidelberg@web.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
  • Loading branch information
Markus Heidelberg authored and Junio C Hamano committed Feb 28, 2010
1 parent 64da6e2 commit 77e8466
Showing 1 changed file with 18 additions and 14 deletions.
32 changes: 18 additions & 14 deletions sha1_name.c
Original file line number Diff line number Diff line change
Expand Up @@ -992,13 +992,15 @@ static void diagnose_invalid_index_path(int stage,
pos = cache_name_pos(filename, namelen);
if (pos < 0)
pos = -pos - 1;
ce = active_cache[pos];
if (ce_namelen(ce) == namelen &&
!memcmp(ce->name, filename, namelen))
die("Path '%s' is in the index, but not at stage %d.\n"
"Did you mean ':%d:%s'?",
filename, stage,
ce_stage(ce), filename);
if (pos < active_nr) {
ce = active_cache[pos];
if (ce_namelen(ce) == namelen &&
!memcmp(ce->name, filename, namelen))
die("Path '%s' is in the index, but not at stage %d.\n"
"Did you mean ':%d:%s'?",
filename, stage,
ce_stage(ce), filename);
}

/* Confusion between relative and absolute filenames? */
fullnamelen = namelen + strlen(prefix);
Expand All @@ -1008,13 +1010,15 @@ static void diagnose_invalid_index_path(int stage,
pos = cache_name_pos(fullname, fullnamelen);
if (pos < 0)
pos = -pos - 1;
ce = active_cache[pos];
if (ce_namelen(ce) == fullnamelen &&
!memcmp(ce->name, fullname, fullnamelen))
die("Path '%s' is in the index, but not '%s'.\n"
"Did you mean ':%d:%s'?",
fullname, filename,
ce_stage(ce), fullname);
if (pos < active_nr) {
ce = active_cache[pos];
if (ce_namelen(ce) == fullnamelen &&
!memcmp(ce->name, fullname, fullnamelen))
die("Path '%s' is in the index, but not '%s'.\n"
"Did you mean ':%d:%s'?",
fullname, filename,
ce_stage(ce), fullname);
}

if (!lstat(filename, &st))
die("Path '%s' exists on disk, but not in the index.", filename);
Expand Down

0 comments on commit 77e8466

Please sign in to comment.