summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLibravatar Johannes Schindelin <Johannes.Schindelin@gmx.de>2009-01-17 16:36:26 +0100
committerLibravatar Junio C Hamano <gitster@pobox.com>2009-01-17 18:19:35 -0800
commit20642801e44a03362d1809644bf4da6473636529 (patch)
tree9f24b9f62d3c82ad44926d03f779620791d48de0
parentMerge branch 'maint-1.6.0' into maint (diff)
downloadtgif-20642801e44a03362d1809644bf4da6473636529.tar.xz
http-push: fix off-by-path_len
When getting the result of remote_ls(), we were advancing the variable "path" to the relative path inside the repository. However, then we went on to malloc a bogus amount of memory: we were subtracting the prefix length _again_, quite possibly getting something negative, which xmalloc() interprets as really, really much. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
-rw-r--r--http-push.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/http-push.c b/http-push.c
index a4b7d08663..2f20995700 100644
--- a/http-push.c
+++ b/http-push.c
@@ -1434,10 +1434,8 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
}
if (path) {
path += remote->path_len;
+ ls->dentry_name = xstrdup(path);
}
- ls->dentry_name = xmalloc(strlen(path) -
- remote->path_len + 1);
- strcpy(ls->dentry_name, path + remote->path_len);
} else if (!strcmp(ctx->name, DAV_PROPFIND_COLLECTION)) {
ls->dentry_flags |= IS_DIR;
}
@@ -1448,6 +1446,12 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
}
}
+/*
+ * NEEDSWORK: remote_ls() ignores info/refs on the remote side. But it
+ * should _only_ heed the information from that file, instead of trying to
+ * determine the refs from the remote file system (badly: it does not even
+ * know about packed-refs).
+ */
static void remote_ls(const char *path, int flags,
void (*userFunc)(struct remote_ls_ctx *ls),
void *userData)