format_sanitized_subject: Don't trim past initial length of strbuf

If the subject line is '...' the strbuf will be accessed before the first dot is added; potentially changing the strbuf passed into the function or accessing sb->buf[-1] if it was originally empty. Reported-by: René Scharfe <rene.scharfe@lsrfire.ath.cx> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Stephen Boyd committed Mar 31, 2009 at 16:24 UTC 871d21d42e0f782b7cb111beec8c252e9aa627ff

1 file changed +4 -2

pretty.c

+4 -2

@@ -502,6 +502,7 @@ static int istitlechar(char c)

502 static void format_sanitized_subject(struct strbuf *sb, const char *msg)

503 {

504 size_t trimlen;

505 + size_t start_len = sb->len;

506 int space = 2;

507

508 for (; *msg && *msg != '\n'; msg++) {

@@ -519,8 +520,9 @@ static void format_sanitized_subject(struct strbuf *sb, const char *msg)

520

521 /* trim any trailing '.' or '-' characters */

522 trimlen = 0;

522 - while (sb->buf[sb->len - 1 - trimlen] == '.'

523 - || sb->buf[sb->len - 1 - trimlen] == '-')

523 + while (sb->len - trimlen > start_len &&

524 + (sb->buf[sb->len - 1 - trimlen] == '.'

525 + || sb->buf[sb->len - 1 - trimlen] == '-'))

526 trimlen++;

527 strbuf_remove(sb, sb->len - trimlen, trimlen);

528 }