summaryrefslogtreecommitdiff
path: root/compat/pread.c
diff options
context:
space:
mode:
authorLibravatar Jeff King <peff@peff.net>2020-01-30 04:52:32 -0500
committerLibravatar Junio C Hamano <gitster@pobox.com>2020-01-30 13:55:02 -0800
commit667b76ec5819b151355e322ad9c6264b9cb3f9cd (patch)
tree1f1ce96d0a62d3ba5eb9672a1f31e139e6d56a7b /compat/pread.c
parentnormalize_path_copy(): document "dst" size expectations (diff)
downloadtgif-667b76ec5819b151355e322ad9c6264b9cb3f9cd.tar.xz
walker_fetch(): avoid raw array length computation
We compute the length of an array of object_id's with a raw multiplication. In theory this could trigger an integer overflow which would cause an under-allocation (and eventually an out of bounds write). I doubt this can be triggered in practice, since you'd need to feed it an enormous number of target objects, which would typically come from the ref advertisement and be using proportional memory. And even on 64-bit systems, where "int" is much smaller than "size_t", that should hold: even though "targets" is an int, the multiplication will be done as a size_t because of the use of sizeof(). But we can easily fix it by using ALLOC_ARRAY(), which uses st_mult() under the hood. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'compat/pread.c')
0 files changed, 0 insertions, 0 deletions