kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

rerere: avoid buffer overrun 

check_one_conflict() compares `i` to `active_nr` in two places to avoid
buffer overruns, but left out an important third location.

The code did used to have a check here comparing i to active_nr, back
before commit fb70a06da2 ("rerere: fix an off-by-one non-bug",
2015-06-28), however the code at the time used an 'if' rather than a
'while' meaning back then that this loop could not have read past the
end of the array, making the check unnecessary and it was removed.
Unfortunately, in commit 5eda906b28 ("rerere: handle conflicts with
multiple stage #1 entries", 2015-07-24), the 'if' was changed to a
'while' and the check comparing i and active_nr was not re-instated,
leading to this problem.

Signed-off-by: Elijah Newren <newren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
maint
Elijah Newren 2018-09-11 11:55:46 -07:00 committed by Junio C Hamano
parent 38c93c4d9d
commit ad2bf0d9b4
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
rerere.c
View File

@ -532,7 +532,7 @@ static int check_one_conflict(int i, int *type)
} }


*type = PUNTED; *type = PUNTED;
while (ce_stage(active_cache[i]) == 1) while (i < active_nr && ce_stage(active_cache[i]) == 1)
i++; i++;


/* Only handle regular files with both stages #2 and #3 */ /* Only handle regular files with both stages #2 and #3 */

2
t/t4200-rerere.sh
View File

@ -599,7 +599,7 @@ test_expect_success 'setup simple stage 1 handling' '
) )
' '


test_expect_failure 'test simple stage 1 handling' ' test_expect_success 'test simple stage 1 handling' '
( (
cd stage_1_handling && cd stage_1_handling &&