summaryrefslogtreecommitdiff
path: root/name-hash.c
diff options
context:
space:
mode:
authorKevin Willford <kewillf@microsoft.com>2017-03-31 17:32:14 (GMT)
committerJunio C Hamano <gitster@pobox.com>2017-04-01 03:57:18 (GMT)
commit2a1bd45b2e44a7ba23dfe67307e7755d0a22e5d6 (patch)
treef8db1fd9379b5a5dd5d7b7ae8498cadec35ae241 /name-hash.c
parent41b3eb4a6bff4d38bb188d28544bf901080d9e96 (diff)
downloadgit-2a1bd45b2e44a7ba23dfe67307e7755d0a22e5d6.zip
git-2a1bd45b2e44a7ba23dfe67307e7755d0a22e5d6.tar.gz
git-2a1bd45b2e44a7ba23dfe67307e7755d0a22e5d6.tar.bz2
name-hash: fix buffer overrun
Add check for the end of the entries for the thread partition. Add test for lazy init name hash with specific directory structure The lazy init hash name was causing a buffer overflow when the last entry in the index was multiple folder deep with parent folders that did not have any files in them. This adds a test for the boundary condition of the thread partitions with the folder structure that was triggering the buffer overflow. The fix was to check if it is the last entry for the thread partition in the handle_range_dir and not try to use the next entry in the cache. Signed-off-by: Kevin Willford <kewillf@microsoft.com> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Jeff Hostetler <jeffhost@microsoft.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'name-hash.c')
-rw-r--r--name-hash.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/name-hash.c b/name-hash.c
index cac313c..39309ef 100644
--- a/name-hash.c
+++ b/name-hash.c
@@ -342,7 +342,9 @@ static int handle_range_dir(
* Scan forward in the index array for index entries having the same
* path prefix (that are also in this directory).
*/
- if (strncmp(istate->cache[k_start + 1]->name, prefix->buf, prefix->len) > 0)
+ if (k_start + 1 >= k_end)
+ k = k_end;
+ else if (strncmp(istate->cache[k_start + 1]->name, prefix->buf, prefix->len) > 0)
k = k_start + 1;
else if (strncmp(istate->cache[k_end - 1]->name, prefix->buf, prefix->len) == 0)
k = k_end;