[PATCH] diff: prevent pprint_rename from underrunning input
From: Thomas Rast <hidden>
Date: 2016-06-15 22:56:16
Subsystem:
the rest · Maintainer:
Linus Torvalds
The logic described in d020e27 (diff: Fix rename pretty-print when suffix and prefix overlap, 2013-02-23) is wrong: The proof in the comment is valid only if both strings are the same length. *One* of old/new can reach a-1 (b-1, resp.) if 'a' is a suffix of 'b' (or vice versa). Since the intent was to let the loop run down to the '/' at the end of the common prefix, fix it by making that distinction explicit: if there is no prefix, allow no underrun. Signed-off-by: Thomas Rast <redacted> --- Hi Antoine, Unfortunately there's this bug in your patch. Luckily it was found by valgrind on t4016 and others. Cheers Thomas diff.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/diff.c b/diff.c
index 7d49cab..8396527 100644
--- a/diff.c
+++ b/diff.c@@ -1264,6 +1264,7 @@ static char *pprint_rename(const char *a, const char *b) const char *new = b; struct strbuf name = STRBUF_INIT; int pfx_length, sfx_length; + int pfx_adjust_for_slash; int len_a = strlen(a); int len_b = strlen(b); int a_midlen, b_midlen;
@@ -1291,14 +1292,16 @@ static char *pprint_rename(const char *a, const char *b) new = b + len_b; sfx_length = 0; /* - * Note: - * if pfx_length is 0, old/new will never reach a - 1 because it - * would mean the whole string is common suffix. But then, the - * whole string would also be a common prefix, and we would not - * have pfx_length equals 0. + * If there is a common prefix, it must end in a slash. In + * that case we let this loop run 1 into the prefix to see the + * same slash. + * + * If there is no common prefix, we cannot do this as it would + * underrun the input strings. */ - while (a + pfx_length - 1 <= old && - b + pfx_length - 1 <= new && + pfx_adjust_for_slash = (pfx_length ? 1 : 0); + while (a + pfx_length - pfx_adjust_for_slash <= old && + b + pfx_length - pfx_adjust_for_slash <= new && *old == *new) { if (*old == '/') sfx_length = len_a - (old - a);
--
1.8.2.rc1.307.ge0d2dea