rerere: avoid buffer overrun

check_one_conflict() compares `i` to `active_nr` in two places to avoid buffer overruns, but left out an important third location. The code did used to have a check here comparing i to active_nr, back before commit fb70a06da2f1 ("rerere: fix an off-by-one non-bug", 2015-06-28), however the code at the time used an 'if' rather than a 'while' meaning back then that this loop could not have read past the end of the array, making the check unnecessary and it was removed. Unfortunately, in commit 5eda906b2873 ("rerere: handle conflicts with multiple stage #1 entries", 2015-07-24), the 'if' was changed to a 'while' and the check comparing i and active_nr was not re-instated, leading to this problem. Signed-off-by: Elijah Newren <newren@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Elijah Newren committed Sep 11, 2018 at 11:55 UTC ad2bf0d9b43433583e88128c278ce31c7ca4e431
2 files changed +2 -2
rerere.c
+1 -1
@@ -532,7 +532,7 @@ static int check_one_conflict(int i, int *type)
532 }
533
534 *type = PUNTED;
535 - while (ce_stage(active_cache[i]) == 1)
535 + while (i < active_nr && ce_stage(active_cache[i]) == 1)
536 i++;
537
538 /* Only handle regular files with both stages #2 and #3 */
t/t4200-rerere.sh
+1 -1
@@ -599,7 +599,7 @@ test_expect_success 'setup simple stage 1 handling' '
599 )
600 '
601
602 -test_expect_failure 'test simple stage 1 handling' '
602 +test_expect_success 'test simple stage 1 handling' '
603 (
604 cd stage_1_handling &&
605