range-set: fix sort_and_merge_range_set() corner case bug
When handed an empty range_set (range_set.nr == 0), sort_and_merge_range_set() incorrectly sets range_set.nr to 1 at exit. Subsequent range_set functions then access the bogus range at element zero and crash or throw an assertion failure. Fix this bug. Signed-off-by: Eric Sunshine <sunshine@sunshineco.com> Acked-by: Thomas Rast <trast@inf.ethz.ch> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Eric Sunshine committed
Jul 23, 2013 at 10:28 UTC
b6679e768f39f718b7f2983d1958f5fb1121f356
1 file changed
+3
-3
line-log.c
+3
-3
@@ -110,12 +110,12 @@ static void range_set_check_invariants(struct range_set *rs)
110
static void sort_and_merge_range_set(struct range_set *rs)
111
{
112
int i;
113
- int o = 1; /* output cursor */
113
+ int o = 0; /* output cursor */
114
115
qsort(rs->ranges, rs->nr, sizeof(struct range), range_cmp);
116
117
- for (i = 1; i < rs->nr; i++) {
118
- if (rs->ranges[i].start <= rs->ranges[o-1].end) {
117
+ for (i = 0; i < rs->nr; i++) {
118
+ if (o > 0 && rs->ranges[i].start <= rs->ranges[o-1].end) {
119
if (rs->ranges[o-1].end < rs->ranges[i].end)
120
rs->ranges[o-1].end = rs->ranges[i].end;
121
} else {