diff options
| author | Johannes Schindelin <johannes.schindelin@gmx.de> | 2017-04-13 19:21:58 (GMT) |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2017-04-14 00:53:08 (GMT) |
| commit | 882add136fa8319832ef373b8797ef58edb80efc (patch) | |
| tree | e36f9c09c1461ff5c06e047946f4eac680184413 /t/t7800-difftool.sh | |
| parent | 0730dd4ffb39358f30b1a956cd9182aed1958b47 (diff) | |
| download | git-882add136fa8319832ef373b8797ef58edb80efc.zip git-882add136fa8319832ef373b8797ef58edb80efc.tar.gz git-882add136fa8319832ef373b8797ef58edb80efc.tar.bz2 | |
difftool: fix use-after-free
The left and right base directories were pointed to the buf field of
two strbufs, which were subject to change.
A contrived test case shows the problem where a file with a long enough
name to force the strbuf to grow is up-to-date (hence the code path is
used where the work tree's version of the file is reused), and then a
file that is not up-to-date needs to be written (hence the code path is
used where checkout_entry() uses the previously recorded base_dir that
is invalid by now).
Let's just copy the base_dir strings for use with checkout_entry(),
never touch them until the end, and release them then. This is an easily
verifiable fix (as opposed to the next-obvious alternative: to re-set
base_dir after every loop iteration).
This fixes https://github.com/git-for-windows/git/issues/1124
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 't/t7800-difftool.sh')
| -rwxr-xr-x | t/t7800-difftool.sh | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/t/t7800-difftool.sh b/t/t7800-difftool.sh index 0e7f30d..7f09867 100755 --- a/t/t7800-difftool.sh +++ b/t/t7800-difftool.sh @@ -393,6 +393,25 @@ test_expect_success 'setup change in subdirectory' ' git commit -m "modified both" ' +test_expect_success 'difftool -d with growing paths' ' + a=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa && + git init growing && + ( + cd growing && + echo "test -f \"\$2/b\"" | write_script .git/test-for-b.sh && + one=$(printf 1 | git hash-object -w --stdin) && + two=$(printf 2 | git hash-object -w --stdin) && + git update-index --add \ + --cacheinfo 100644,$one,$a --cacheinfo 100644,$two,b && + tree1=$(git write-tree) && + git update-index --add \ + --cacheinfo 100644,$two,$a --cacheinfo 100644,$one,b && + tree2=$(git write-tree) && + git checkout -- $a && + git difftool -d --extcmd .git/test-for-b.sh $tree1 $tree2 + ) +' + run_dir_diff_test () { test_expect_success "$1 --no-symlinks" " symlinks=--no-symlinks && |