sha1_name: fix segfault caused by invalid index access
The code to see if user input "git show :path" makes sense tried to access the index without properly checking the array bound. Signed-off-by: Markus Heidelberg <markus.heidelberg@web.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Markus Heidelberg committed
Feb 28, 2010 at 16:49 UTC
77e8466fb98b95ea07d386d64073d0bc6304b37f
1 file changed
+18
-14
sha1_name.c
+18
-14
@@ -992,13 +992,15 @@ static void diagnose_invalid_index_path(int stage,
992
pos = cache_name_pos(filename, namelen);
993
if (pos < 0)
994
pos = -pos - 1;
995
- ce = active_cache[pos];
996
- if (ce_namelen(ce) == namelen &&
997
- !memcmp(ce->name, filename, namelen))
998
- die("Path '%s' is in the index, but not at stage %d.\n"
999
- "Did you mean ':%d:%s'?",
1000
- filename, stage,
1001
- ce_stage(ce), filename);
995
+ if (pos < active_nr) {
996
+ ce = active_cache[pos];
997
+ if (ce_namelen(ce) == namelen &&
998
+ !memcmp(ce->name, filename, namelen))
999
+ die("Path '%s' is in the index, but not at stage %d.\n"
1000
+ "Did you mean ':%d:%s'?",
1001
+ filename, stage,
1002
+ ce_stage(ce), filename);
1003
+ }
1004
1005
/* Confusion between relative and absolute filenames? */
1006
fullnamelen = namelen + strlen(prefix);
@@ -1008,13 +1010,15 @@ static void diagnose_invalid_index_path(int stage,
1010
pos = cache_name_pos(fullname, fullnamelen);
1011
if (pos < 0)
1012
pos = -pos - 1;
1011
- ce = active_cache[pos];
1012
- if (ce_namelen(ce) == fullnamelen &&
1013
- !memcmp(ce->name, fullname, fullnamelen))
1014
- die("Path '%s' is in the index, but not '%s'.\n"
1015
- "Did you mean ':%d:%s'?",
1016
- fullname, filename,
1017
- ce_stage(ce), fullname);
1013
+ if (pos < active_nr) {
1014
+ ce = active_cache[pos];
1015
+ if (ce_namelen(ce) == fullnamelen &&
1016
+ !memcmp(ce->name, fullname, fullnamelen))
1017
+ die("Path '%s' is in the index, but not '%s'.\n"
1018
+ "Did you mean ':%d:%s'?",
1019
+ fullname, filename,
1020
+ ce_stage(ce), fullname);
1021
+ }
1022
1023
if (!lstat(filename, &st))
1024
die("Path '%s' exists on disk, but not in the index.", filename);