setup.c: stop prefix_pathspec() from looping past the end of string
The code assumes that the string ends at either `)` or `,`, and does not handle the case where strcspn() returns length due to end of string. So specifying ":(top" as pathspec will cause the loop to go past the end of string. Signed-off-by: Andrew Wong <andrew.kw.w@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Andrew Wong committed
Mar 7, 2013 at 11:36 UTC
772e47cd673e048adb0f7b663617ec70e0cfe598
1 file changed
+4
-3
setup.c
+4
-3
@@ -199,10 +199,11 @@ static const char *prefix_pathspec(const char *prefix, int prefixlen, const char
199
*copyfrom && *copyfrom != ')';
200
copyfrom = nextat) {
201
size_t len = strcspn(copyfrom, ",)");
202
- if (copyfrom[len] == ')')
203
- nextat = copyfrom + len;
204
- else
202
+ if (copyfrom[len] == ',')
203
nextat = copyfrom + len + 1;
204
+ else
205
+ /* handle ')' and '\0' */
206
+ nextat = copyfrom + len;
207
if (!len)
208
continue;
209
for (i = 0; i < ARRAY_SIZE(pathspec_magic); i++)