From 38c93c4d9d11b881697229d15420fc5c1367d7a9 Mon Sep 17 00:00:00 2001 From: Elijah Newren Date: Tue, 11 Sep 2018 11:55:45 -0700 Subject: t4200: demonstrate rerere segfault on specially crafted merge Signed-off-by: Elijah Newren Signed-off-by: Junio C Hamano --- t/t4200-rerere.sh | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 't') diff --git a/t/t4200-rerere.sh b/t/t4200-rerere.sh index d97d2bebc9..ed9e495fa7 100755 --- a/t/t4200-rerere.sh +++ b/t/t4200-rerere.sh @@ -580,4 +580,33 @@ test_expect_success 'multiple identical conflicts' ' count_pre_post 0 0 ' +test_expect_success 'setup simple stage 1 handling' ' + test_create_repo stage_1_handling && + ( + cd stage_1_handling && + + test_seq 1 10 >original && + git add original && + git commit -m original && + + git checkout -b A master && + git mv original A && + git commit -m "rename to A" && + + git checkout -b B master && + git mv original B && + git commit -m "rename to B" + ) +' + +test_expect_failure 'test simple stage 1 handling' ' + ( + cd stage_1_handling && + + git config rerere.enabled true && + git checkout A^0 && + test_must_fail git merge B^0 + ) +' + test_done -- cgit v1.2.3 From ad2bf0d9b43433583e88128c278ce31c7ca4e431 Mon Sep 17 00:00:00 2001 From: Elijah Newren Date: Tue, 11 Sep 2018 11:55:46 -0700 Subject: rerere: avoid buffer overrun check_one_conflict() compares `i` to `active_nr` in two places to avoid buffer overruns, but left out an important third location. The code did used to have a check here comparing i to active_nr, back before commit fb70a06da2f1 ("rerere: fix an off-by-one non-bug", 2015-06-28), however the code at the time used an 'if' rather than a 'while' meaning back then that this loop could not have read past the end of the array, making the check unnecessary and it was removed. Unfortunately, in commit 5eda906b2873 ("rerere: handle conflicts with multiple stage #1 entries", 2015-07-24), the 'if' was changed to a 'while' and the check comparing i and active_nr was not re-instated, leading to this problem. Signed-off-by: Elijah Newren Signed-off-by: Junio C Hamano --- t/t4200-rerere.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 't') diff --git a/t/t4200-rerere.sh b/t/t4200-rerere.sh index ed9e495fa7..8da998f661 100755 --- a/t/t4200-rerere.sh +++ b/t/t4200-rerere.sh @@ -599,7 +599,7 @@ test_expect_success 'setup simple stage 1 handling' ' ) ' -test_expect_failure 'test simple stage 1 handling' ' +test_expect_success 'test simple stage 1 handling' ' ( cd stage_1_handling && -- cgit v1.2.3