undef/git-commit-vandalism
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix memory corruption when .gitignore does not end by \n

Browse Source 
Commit b5041c5 (Avoid writing to buffer in add_excludes_from_file_1())
tried not to append '\n' at the end because the next commit
may return a buffer that does not have extra space for that.

Unfortunately it left this assignment in the loop:

  buf[i - (i && buf[i-1] == '\r')] = 0;

that can corrupt memory if "buf" is not '\n' terminated. But even if
it does not corrupt memory, the last line would not be
NULL-terminated, leading to errors later inside add_exclude().

This patch fixes it by reverting the faulty commit and make
sure "buf" is always \n terminated.

While at it, free unused memory properly.

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Nguyễn Thái Ngọc Duy 2010-01-20 21:09:16 +07:00 committed by Junio C Hamano
parent 19c61a58cf
commit 45d76f1718
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
dir.c
View File

@ -242,6 +242,14 @@ int add_excludes_from_file_to_list(const char *fname,
if (!check_index || if (!check_index ||
(buf = read_skip_worktree_file_from_index(fname, &size)) == NULL) (buf = read_skip_worktree_file_from_index(fname, &size)) == NULL)
return -1; return -1;
if (size == 0) {
free(buf);
return 0;
}
if (buf[size-1] != '\n') {
buf = xrealloc(buf, size+1);
buf[size++] = '\n';
}
} }
else { else {
size = xsize_t(st.st_size); size = xsize_t(st.st_size);
@ -249,19 +257,21 @@ int add_excludes_from_file_to_list(const char *fname,
close(fd); close(fd);
return 0; return 0;
} }
buf = xmalloc(size); buf = xmalloc(size+1);
if (read_in_full(fd, buf, size) != size) { if (read_in_full(fd, buf, size) != size) {
free(buf);
close(fd); close(fd);
return -1; return -1;
} }
buf[size++] = '\n';
close(fd); close(fd);
} }
if (buf_p) if (buf_p)
*buf_p = buf; *buf_p = buf;
entry = buf; entry = buf;
for (i = 0; i <= size; i++) { for (i = 0; i < size; i++) {
if (i == size || buf[i] == '\n') { if (buf[i] == '\n') {
if (entry != buf + i && entry[0] != '#') { if (entry != buf + i && entry[0] != '#') {
buf[i - (i && buf[i-1] == '\r')] = 0; buf[i - (i && buf[i-1] == '\r')] = 0;
add_exclude(entry, base, baselen, which); add_exclude(entry, base, baselen, which);