merge: fix out-of-bounds memory access
The parameter n of unpack_callback() can have a value of up to MAX_UNPACK_TREES. The check at the top of unpack_trees() (its only (indirect) caller) makes sure it cannot exceed this limit. unpack_callback() passes it and the array src to unpack_nondirectories(), which has this loop: for (i = 0; i < n; i++) { /* ... */ src[i + o->merge] = o->df_conflict_entry; o->merge can be 0 or 1, so unpack_nondirectories() potentially accesses the array src at index MAX_UNPACK_TREES. This patch makes it big enough. Reported-by: Ingo Molnar <mingo@elte.hu> Signed-off-by: René Scharfe <rene.scharfe@lsrfire.ath.cx> Signed-off-by: Junio C Hamano <gitster@pobox.com>
René Scharfe committed
Jan 31, 2009 at 15:39 UTC
c7cddc1a2f365e4f4aea71b700c0b833eb436fee
1 file changed
+6
-3
unpack-trees.c
+6
-3
@@ -240,8 +240,11 @@ static struct cache_entry *create_ce_entry(const struct traverse_info *info, con
240
return ce;
241
}
242
243
-static int unpack_nondirectories(int n, unsigned long mask, unsigned long dirmask, struct cache_entry *src[5],
244
- const struct name_entry *names, const struct traverse_info *info)
243
+static int unpack_nondirectories(int n, unsigned long mask,
244
+ unsigned long dirmask,
245
+ struct cache_entry **src,
246
+ const struct name_entry *names,
247
+ const struct traverse_info *info)
248
{
249
int i;
250
struct unpack_trees_options *o = info->data;
@@ -291,7 +294,7 @@ static int unpack_nondirectories(int n, unsigned long mask, unsigned long dirmas
294
295
static int unpack_callback(int n, unsigned long mask, unsigned long dirmask, struct name_entry *names, struct traverse_info *info)
296
{
294
- struct cache_entry *src[5] = { NULL, };
297
+ struct cache_entry *src[MAX_UNPACK_TREES + 1] = { NULL, };
298
struct unpack_trees_options *o = info->data;
299
const struct name_entry *p = names;
300