undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

unpack-trees: make sure "df_conflict_entry.name" is NUL terminated.

Browse Source 
The structure that ends with a flexible array member (or 0
length array with older GCC) "char name[FLEX_ARRAY]" is
allocated on the stack and we use it after clearing its entire
size with memset.  That does not guarantee that "name" is
properly NUL terminated as we intended on platforms with more
forgiving structure alignment requirements.

Reported breakage on m68k by Roman Zippel.

Signed-off-by: Junio C Hamano <junkio@cox.net>
This commit is contained in:
Junio C Hamano 2006-12-04 02:11:39 -08:00
parent 562cefbdbf
commit 0fb1eaa885
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
unpack-trees.c
View File

@ -370,7 +370,7 @@ int unpack_trees(struct object_list *trees, struct unpack_trees_options *o)
int i; int i;
struct object_list *posn = trees; struct object_list *posn = trees;
struct tree_entry_list df_conflict_list; struct tree_entry_list df_conflict_list;
struct cache_entry df_conflict_entry; static struct cache_entry *dfc;
memset(&df_conflict_list, 0, sizeof(df_conflict_list)); memset(&df_conflict_list, 0, sizeof(df_conflict_list));
df_conflict_list.next = &df_conflict_list; df_conflict_list.next = &df_conflict_list;
@ -381,8 +381,10 @@ int unpack_trees(struct object_list *trees, struct unpack_trees_options *o)
state.refresh_cache = 1; state.refresh_cache = 1;
o->merge_size = len; o->merge_size = len;
memset(&df_conflict_entry, 0, sizeof(df_conflict_entry));
o->df_conflict_entry = &df_conflict_entry; if (!dfc)
dfc = xcalloc(1, sizeof(struct cache_entry) + 1);
o->df_conflict_entry = dfc;
if (len) { if (len) {
posns = xmalloc(len * sizeof(struct tree_entry_list *)); posns = xmalloc(len * sizeof(struct tree_entry_list *));