summaryrefslogtreecommitdiff
path: root/rerere.c
diff options
context:
space:
mode:
authorElijah Newren <newren@gmail.com>2018-09-11 18:55:46 (GMT)
committerJunio C Hamano <gitster@pobox.com>2018-09-11 20:43:23 (GMT)
commitad2bf0d9b43433583e88128c278ce31c7ca4e431 (patch)
treec1fee749f5008da8717513b3f206a82251bb84f9 /rerere.c
parent38c93c4d9d11b881697229d15420fc5c1367d7a9 (diff)
downloadgit-ad2bf0d9b43433583e88128c278ce31c7ca4e431.zip
git-ad2bf0d9b43433583e88128c278ce31c7ca4e431.tar.gz
git-ad2bf0d9b43433583e88128c278ce31c7ca4e431.tar.bz2
rerere: avoid buffer overrun
check_one_conflict() compares `i` to `active_nr` in two places to avoid buffer overruns, but left out an important third location. The code did used to have a check here comparing i to active_nr, back before commit fb70a06da2f1 ("rerere: fix an off-by-one non-bug", 2015-06-28), however the code at the time used an 'if' rather than a 'while' meaning back then that this loop could not have read past the end of the array, making the check unnecessary and it was removed. Unfortunately, in commit 5eda906b2873 ("rerere: handle conflicts with multiple stage #1 entries", 2015-07-24), the 'if' was changed to a 'while' and the check comparing i and active_nr was not re-instated, leading to this problem. Signed-off-by: Elijah Newren <newren@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'rerere.c')
-rw-r--r--rerere.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/rerere.c b/rerere.c
index ea24d4c..ee02dd3 100644
--- a/rerere.c
+++ b/rerere.c
@@ -532,7 +532,7 @@ static int check_one_conflict(int i, int *type)
}
*type = PUNTED;
- while (ce_stage(active_cache[i]) == 1)
+ while (i < active_nr && ce_stage(active_cache[i]) == 1)
i++;
/* Only handle regular files with both stages #2 and #3 */