Fix cloning (memory corruption)

upload-pack would set create_full_pack=1 if nr_has==0, but would ask later
if nr_needs<MAX_NEEDS. If that proves true, it would ignore create_full_pack,
and arguments would be written into unreserved memory.

Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>

diff --git a/upload-pack.c b/upload-pack.c
index 07c150595efef02d8b5d115a55e261c31f73cebb..878254d72f6448ff3a6cfb59650ef9a71d75ddde 100644 (file)
--- a/upload-pack.c
+++ b/upload-pack.c
@@ -60,7 +60,7 @@ static void create_pack_file(void)
                close(fd[1]);
                *p++ = "git-rev-list";
                *p++ = "--objects";
-               if (MAX_NEEDS <= nr_needs)
+               if (create_full_pack || MAX_NEEDS <= nr_needs)
                        *p++ = "--all";
                else {
                        for (i = 0; i < nr_needs; i++) {
@@ -69,12 +69,13 @@ static void create_pack_file(void)
                                buf += 41;
                        }
                }
-               for (i = 0; i < nr_has; i++) {
-                       *p++ = buf;
-                       *buf++ = '^';
-                       memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
-                       buf += 41;
-               }
+               if (!create_full_pack)
+                       for (i = 0; i < nr_has; i++) {
+                               *p++ = buf;
+                               *buf++ = '^';
+                               memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
+                               buf += 41;
+                       }
                *p++ = NULL;
                execvp("git-rev-list", argv);
                die("git-upload-pack: unable to exec git-rev-list");