@matheusbsbs / matheus-bagliano / commits / 0eeb3be4c4
Fork 0

unpack-trees: avoid array out-of-bounds error

The loop in warn_conflicted_path() that checks for the count of entries with the same path uses "i+count" for the array entry. However, the loop only verifies that the value of count is below the array size. Fix this by adding i to the condition. I hit this condition during a test of the in-tree sparse-checkout feature, so it is exercised by the end of the series. Signed-off-by: Derrick Stolee <dstolee@microsoft.com> [jc: readability fix] Signed-off-by: Junio C Hamano <gitster@pobox.com>

Derrick Stolee committed May 7, 2020 at 13:17 UTC 0eeb3be4c4b297f9edb94c4741af606df396985d
1 file changed +5 -5
unpack-trees.c
+5 -5
@@ -562,11 +562,11 @@ static int warn_conflicted_path(struct index_state *istate,
562
563 add_rejected_path(o, WARNING_SPARSE_UNMERGED_FILE, conflicting_path);
564
565 - /* Find out how many higher stage entries at same path */
566 - while (++count < istate->cache_nr &&
567 - !strcmp(conflicting_path,
568 - istate->cache[i+count]->name))
569 - /* do nothing */;
565 + /* Find out how many higher stage entries are at same path */
566 + while ((++count) + i < istate->cache_nr &&
567 + !strcmp(conflicting_path, istate->cache[count + i]->name))
568 + ; /* do nothing */
569 +
570 return count;
571 }
572