[PATCH] off-by-one bugs found by valgrind
From: Pavel Roskin <hidden>
Date: 2016-06-15 22:42:15
Subsystem:
the rest · Maintainer:
Linus Torvalds
Insufficient memory is allocated in index-pack.c to hold the *.idx name. One more byte should be allocated to hold the terminating 0. quote_c_style_counted() in quote.c uses a dangerous construct, when a variable is incremented once and used twice in the same expression. Convert this construct to a more traditional form of the for loop. Signed-off-by: Pavel Roskin <redacted>
diff --git a/index-pack.c b/index-pack.c
index 785fe71..d4ce3af 100644
--- a/index-pack.c
+++ b/index-pack.c@@ -440,7 +440,7 @@ int main(int argc, char **argv) if (len < 5 || strcmp(pack_name + len - 5, ".pack")) die("packfile name '%s' does not end with '.pack'", pack_name); - index_name_buf = xmalloc(len - 1); + index_name_buf = xmalloc(len); memcpy(index_name_buf, pack_name, len - 5); strcpy(index_name_buf + len - 5, ".idx"); index_name = index_name_buf;
diff --git a/quote.c b/quote.c
index 76eb144..00297b5 100644
--- a/quote.c
+++ b/quote.c@@ -126,8 +126,10 @@ static int quote_c_style_counted(const c if (!no_dq) EMIT('"'); - for (sp = name; (ch = *sp++) && (sp - name) <= namelen; ) { - + for (sp = name; sp < name + namelen; sp++) { + ch = *sp; + if (!ch) + break; if ((ch < ' ') || (ch == '"') || (ch == '\\') || (ch == 0177)) { needquote = 1;
--
Regards,
Pavel Roskin