Insufficient memory is allocated in index-pack.c to hold the *.idx name. One more byte should be allocated to hold the terminating 0. quote_c_style_counted() in quote.c uses a dangerous construct, when a variable is incremented once and used twice in the same expression. Convert this construct to a more traditional form of the for loop. Signed-off-by: Pavel Roskin <proski@gnu.org> diff --git a/index-pack.c b/index-pack.c index 785fe71..d4ce3af 100644 --- a/index-pack.c +++ b/index-pack.c @@ -440,7 +440,7 @@ int main(int argc, char **argv) if (len < 5 || strcmp(pack_name + len - 5, ".pack")) die("packfile name '%s' does not end with '.pack'", pack_name); - index_name_buf = xmalloc(len - 1); + index_name_buf = xmalloc(len); memcpy(index_name_buf, pack_name, len - 5); strcpy(index_name_buf + len - 5, ".idx"); index_name = index_name_buf; diff --git a/quote.c b/quote.c index 76eb144..00297b5 100644 --- a/quote.c +++ b/quote.c @@ -126,8 +126,10 @@ static int quote_c_style_counted(const c if (!no_dq) EMIT('"'); - for (sp = name; (ch = *sp++) && (sp - name) <= namelen; ) { - + for (sp = name; sp < name + namelen; sp++) { + ch = *sp; + if (!ch) + break; if ((ch < ' ') || (ch == '"') || (ch == '\\') || (ch == 0177)) { needquote = 1; -- Regards, Pavel Roskin - To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.htmlReceived on Thu Dec 22 07:38:11 2005
This archive was generated by hypermail 2.1.8 : 2005-12-22 07:38:18 EST