http-push: fix off-by-path_len
When getting the result of remote_ls(), we were advancing the variable "path" to the relative path inside the repository. However, then we went on to malloc a bogus amount of memory: we were subtracting the prefix length _again_, quite possibly getting something negative, which xmalloc() interprets as really, really much. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Johannes Schindelin committed
Jan 17, 2009 at 16:36 UTC
20642801e44a03362d1809644bf4da6473636529
1 file changed
+7
-3
http-push.c
+7
-3
@@ -1434,10 +1434,8 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
1434
}
1435
if (path) {
1436
path += remote->path_len;
1437
+ ls->dentry_name = xstrdup(path);
1438
}
1438
- ls->dentry_name = xmalloc(strlen(path) -
1439
- remote->path_len + 1);
1440
- strcpy(ls->dentry_name, path + remote->path_len);
1439
} else if (!strcmp(ctx->name, DAV_PROPFIND_COLLECTION)) {
1440
ls->dentry_flags |= IS_DIR;
1441
}
@@ -1448,6 +1446,12 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
1446
}
1447
}
1448
1449
+/*
1450
+ * NEEDSWORK: remote_ls() ignores info/refs on the remote side. But it
1451
+ * should _only_ heed the information from that file, instead of trying to
1452
+ * determine the refs from the remote file system (badly: it does not even
1453
+ * know about packed-refs).
1454
+ */
1455
static void remote_ls(const char *path, int flags,
1456
void (*userFunc)(struct remote_ls_ctx *ls),
1457
void *userData)