50a6c8efa2
If our size computation overflows size_t, we may allocate a much smaller buffer than we expected and overflow it. It's probably impossible to trigger an overflow in most of these sites in practice, but it is easy enough convert their additions and multiplications into overflow-checking variants. This may be fixing real bugs, and it makes auditing the code easier. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
63 lines
1.2 KiB
C
63 lines
1.2 KiB
C
#include "../git-compat-util.h"
|
|
|
|
/*
|
|
* A merge sort implementation, simplified from the qsort implementation
|
|
* by Mike Haertel, which is a part of the GNU C Library.
|
|
*/
|
|
|
|
static void msort_with_tmp(void *b, size_t n, size_t s,
|
|
int (*cmp)(const void *, const void *),
|
|
char *t)
|
|
{
|
|
char *tmp;
|
|
char *b1, *b2;
|
|
size_t n1, n2;
|
|
|
|
if (n <= 1)
|
|
return;
|
|
|
|
n1 = n / 2;
|
|
n2 = n - n1;
|
|
b1 = b;
|
|
b2 = (char *)b + (n1 * s);
|
|
|
|
msort_with_tmp(b1, n1, s, cmp, t);
|
|
msort_with_tmp(b2, n2, s, cmp, t);
|
|
|
|
tmp = t;
|
|
|
|
while (n1 > 0 && n2 > 0) {
|
|
if (cmp(b1, b2) <= 0) {
|
|
memcpy(tmp, b1, s);
|
|
tmp += s;
|
|
b1 += s;
|
|
--n1;
|
|
} else {
|
|
memcpy(tmp, b2, s);
|
|
tmp += s;
|
|
b2 += s;
|
|
--n2;
|
|
}
|
|
}
|
|
if (n1 > 0)
|
|
memcpy(tmp, b1, n1 * s);
|
|
memcpy(b, t, (n - n2) * s);
|
|
}
|
|
|
|
void git_qsort(void *b, size_t n, size_t s,
|
|
int (*cmp)(const void *, const void *))
|
|
{
|
|
const size_t size = st_mult(n, s);
|
|
char buf[1024];
|
|
|
|
if (size < sizeof(buf)) {
|
|
/* The temporary array fits on the small on-stack buffer. */
|
|
msort_with_tmp(b, n, s, cmp, buf);
|
|
} else {
|
|
/* It's somewhat large, so malloc it. */
|
|
char *tmp = xmalloc(size);
|
|
msort_with_tmp(b, n, s, cmp, tmp);
|
|
free(tmp);
|
|
}
|
|
}
|