http-push: fix off-by-path_len

When getting the result of remote_ls(), we were advancing the variable
"path" to the relative path inside the repository.

However, then we went on to malloc a bogus amount of memory: we were
subtracting the prefix length _again_, quite possibly getting something
negative, which xmalloc() interprets as really, really much.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/http-push.c b/http-push.c
index a4b7d08663504a57008f66a39fffe293f62c1d08..2f2099570077dcff20e217fd6b5b2bdcbdb80368 100644 (file)
--- a/http-push.c
+++ b/http-push.c
@@ -1434,10 +1434,8 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
                        }
                        if (path) {
                                path += remote->path_len;
+                               ls->dentry_name = xstrdup(path);
                        }
-                       ls->dentry_name = xmalloc(strlen(path) -
-                                                 remote->path_len + 1);
-                       strcpy(ls->dentry_name, path + remote->path_len);
                } else if (!strcmp(ctx->name, DAV_PROPFIND_COLLECTION)) {
                        ls->dentry_flags |= IS_DIR;
                }
@@ -1448,6 +1446,12 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
        }
 }
 
+/*
+ * NEEDSWORK: remote_ls() ignores info/refs on the remote side.  But it
+ * should _only_ heed the information from that file, instead of trying to
+ * determine the refs from the remote file system (badly: it does not even
+ * know about packed-refs).
+ */
 static void remote_ls(const char *path, int flags,
                      void (*userFunc)(struct remote_ls_ctx *ls),
                      void *userData)