karsten.blees@dcon.de writes:
OT: While looking at the code I just stumbled across this immediately
above the patch (prune-packed.c line 32ff):
memcpy(pathname + len, de->d_name, 38);
if (opts & DRY_RUN)
printf("rm -f %s\n", pathname);
else
unlink_or_warn(pathname);
Shouldn't this be memcpy(..., 39) (i.e. including '\0')?
I think the only thing that is guaranteeing that pathname[len+38] is
NUL is that we do not hop around repositories, so once we fill the
static char pathname[PATH_MAX] in prune_packed_objects(), nobody
writes to that location, because the length of the leading part
(i.e. "len" given to prune_dir()) will stay constant during the
lifetime of the process.
So it is not currently a problem, but it would be better to clear
that byte here.
Good eyes.