From 871d21d42e0f782b7cb111beec8c252e9aa627ff Mon Sep 17 00:00:00 2001 From: Stephen Boyd Date: Tue, 31 Mar 2009 16:24:38 -0700 Subject: [PATCH] format_sanitized_subject: Don't trim past initial length of strbuf MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit If the subject line is '...' the strbuf will be accessed before the first dot is added; potentially changing the strbuf passed into the function or accessing sb->buf[-1] if it was originally empty. Reported-by: René Scharfe Signed-off-by: Junio C Hamano --- pretty.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/pretty.c b/pretty.c index c57cef47c..a0ef35655 100644 --- a/pretty.c +++ b/pretty.c @@ -502,6 +502,7 @@ static int istitlechar(char c) static void format_sanitized_subject(struct strbuf *sb, const char *msg) { size_t trimlen; + size_t start_len = sb->len; int space = 2; for (; *msg && *msg != '\n'; msg++) { @@ -519,8 +520,9 @@ static void format_sanitized_subject(struct strbuf *sb, const char *msg) /* trim any trailing '.' or '-' characters */ trimlen = 0; - while (sb->buf[sb->len - 1 - trimlen] == '.' - || sb->buf[sb->len - 1 - trimlen] == '-') + while (sb->len - trimlen > start_len && + (sb->buf[sb->len - 1 - trimlen] == '.' + || sb->buf[sb->len - 1 - trimlen] == '-')) trimlen++; strbuf_remove(sb, sb->len - trimlen, trimlen); } -- 2.30.2