From 25b334d8dbcae2683e60484b026a84eda4aa8c22 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Wed, 30 Sep 2026 19:44:13 -0400 Subject: [PATCH] xdiff: NUL-terminate buffers read by read_mmfile() Since an mmfile_t is a ptr/len pair, our read_mmfile() allocates exactly the number of bytes we claim to store. But in many other places in Git, we add an extra NUL "just in case", which can help avoid read overruns due to off-by-ones or the use of string functions. I don't know of any path that would benefit from this, but I noticed it while converting ll_ext_merge() to use read_mmfile(), since its original code did add a NUL byte (even though I cannot find any case where it would have mattered). Let's add the same defensive NUL in read_mmfile() by using xmallocz() instead of xmalloc(). Note that the matching read_mmblob() doesn't need the same treatment. Its buffers already have a NUL from the object-reading code (which uses the same defensive trick). As a bonus, we can get rid of the hack in read_mmfile() to handle empty files by allocating a single byte. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- xdiff-interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xdiff-interface.c b/xdiff-interface.c index bc340d5a8a..b3e9f1952b 100644 --- a/xdiff-interface.c +++ b/xdiff-interface.c @@ -166,7 +166,7 @@ int read_mmfile(mmfile_t *ptr, const char *filename) if (!(f = fopen(filename, "rb"))) return error_errno("Could not open %s", filename); sz = xsize_t(st.st_size); - ptr->ptr = xmalloc(sz ? sz : 1); + ptr->ptr = xmallocz(sz); if (sz && fread(ptr->ptr, sz, 1, f) != 1) { FREE_AND_NULL(ptr->ptr); fclose(f);