[PATCH v2 02/31] mailinfo: fix for off-by-one error in boundary stack
From: Junio C Hamano <hidden>
Date: 2016-06-15 23:06:52
Subsystem:
the rest · Maintainer:
Linus Torvalds
We pre-increment the pointer that we will use to store something at, so the pointer is already beyond the end of the array if it points at content[MAX_BOUNDARIES]. Signed-off-by: Junio C Hamano <redacted> --- builtin/mailinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/builtin/mailinfo.c b/builtin/mailinfo.c
index 5a4ed75..d3756cc 100644
--- a/builtin/mailinfo.c
+++ b/builtin/mailinfo.c@@ -185,7 +185,7 @@ static void handle_content_type(struct strbuf *line) if (slurp_attr(line->buf, "boundary=", boundary)) { strbuf_insert(boundary, 0, "--", 2); - if (++content_top > &content[MAX_BOUNDARIES]) { + if (++content_top >= &content[MAX_BOUNDARIES]) { fprintf(stderr, "Too many boundaries to handle\n"); exit(1); }
--
2.6.1-320-g86a1181