diff options
| author |  Elijah Newren <newren@gmail.com> | 2018-09-11 11:55:46 -0700 |
|---|---|---|
| committer |  Junio C Hamano <gitster@pobox.com> | 2018-09-11 13:43:23 -0700 |
| commit | ad2bf0d9b43433583e88128c278ce31c7ca4e431 (patch) | |
| tree | c1fee749f5008da8717513b3f206a82251bb84f9 /t | |
| parent | t4200: demonstrate rerere segfault on specially crafted merge (diff) | |
| download | tgif-ad2bf0d9b43433583e88128c278ce31c7ca4e431.tar.xz | |
rerere: avoid buffer overrun
check_one_conflict() compares `i` to `active_nr` in two places to avoid
buffer overruns, but left out an important third location.
The code did used to have a check here comparing i to active_nr, back
before commit fb70a06da2f1 ("rerere: fix an off-by-one non-bug",
2015-06-28), however the code at the time used an 'if' rather than a
'while' meaning back then that this loop could not have read past the
end of the array, making the check unnecessary and it was removed.
Unfortunately, in commit 5eda906b2873 ("rerere: handle conflicts with
multiple stage #1 entries", 2015-07-24), the 'if' was changed to a
'while' and the check comparing i and active_nr was not re-instated,
leading to this problem.
Signed-off-by: Elijah Newren <newren@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 't')
| -rwxr-xr-x | t/t4200-rerere.sh | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/t/t4200-rerere.sh b/t/t4200-rerere.sh index ed9e495fa7..8da998f661 100755 --- a/t/t4200-rerere.sh +++ b/t/t4200-rerere.sh @@ -599,7 +599,7 @@ test_expect_success 'setup simple stage 1 handling' ' ) ' -test_expect_failure 'test simple stage 1 handling' ' +test_expect_success 'test simple stage 1 handling' ' ( cd stage_1_handling && |