Code

Fix cloning (memory corruption)
authorJohannes Schindelin <Johannes.Schindelin@gmx.de>
Wed, 26 Oct 2005 14:18:56 +0000 (16:18 +0200)
committerJunio C Hamano <junkio@cox.net>
Wed, 26 Oct 2005 18:52:19 +0000 (11:52 -0700)
upload-pack would set create_full_pack=1 if nr_has==0, but would ask later
if nr_needs<MAX_NEEDS. If that proves true, it would ignore create_full_pack,
and arguments would be written into unreserved memory.

Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
upload-pack.c

index 07c150595efef02d8b5d115a55e261c31f73cebb..878254d72f6448ff3a6cfb59650ef9a71d75ddde 100644 (file)
@@ -60,7 +60,7 @@ static void create_pack_file(void)
                close(fd[1]);
                *p++ = "git-rev-list";
                *p++ = "--objects";
-               if (MAX_NEEDS <= nr_needs)
+               if (create_full_pack || MAX_NEEDS <= nr_needs)
                        *p++ = "--all";
                else {
                        for (i = 0; i < nr_needs; i++) {
@@ -69,12 +69,13 @@ static void create_pack_file(void)
                                buf += 41;
                        }
                }
-               for (i = 0; i < nr_has; i++) {
-                       *p++ = buf;
-                       *buf++ = '^';
-                       memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
-                       buf += 41;
-               }
+               if (!create_full_pack)
+                       for (i = 0; i < nr_has; i++) {
+                               *p++ = buf;
+                               *buf++ = '^';
+                               memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
+                               buf += 41;
+                       }
                *p++ = NULL;
                execvp("git-rev-list", argv);
                die("git-upload-pack: unable to exec git-rev-list");