mirror of
https://github.com/git/git
synced 2024-08-27 11:39:22 +00:00
http-push: fix off-by-path_len
When getting the result of remote_ls(), we were advancing the variable "path" to the relative path inside the repository. However, then we went on to malloc a bogus amount of memory: we were subtracting the prefix length _again_, quite possibly getting something negative, which xmalloc() interprets as really, really much. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
parent
ebb7bbf769
commit
20642801e4
10
http-push.c
10
http-push.c
|
@ -1434,10 +1434,8 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
|
||||||
}
|
}
|
||||||
if (path) {
|
if (path) {
|
||||||
path += remote->path_len;
|
path += remote->path_len;
|
||||||
|
ls->dentry_name = xstrdup(path);
|
||||||
}
|
}
|
||||||
ls->dentry_name = xmalloc(strlen(path) -
|
|
||||||
remote->path_len + 1);
|
|
||||||
strcpy(ls->dentry_name, path + remote->path_len);
|
|
||||||
} else if (!strcmp(ctx->name, DAV_PROPFIND_COLLECTION)) {
|
} else if (!strcmp(ctx->name, DAV_PROPFIND_COLLECTION)) {
|
||||||
ls->dentry_flags |= IS_DIR;
|
ls->dentry_flags |= IS_DIR;
|
||||||
}
|
}
|
||||||
|
@ -1448,6 +1446,12 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* NEEDSWORK: remote_ls() ignores info/refs on the remote side. But it
|
||||||
|
* should _only_ heed the information from that file, instead of trying to
|
||||||
|
* determine the refs from the remote file system (badly: it does not even
|
||||||
|
* know about packed-refs).
|
||||||
|
*/
|
||||||
static void remote_ls(const char *path, int flags,
|
static void remote_ls(const char *path, int flags,
|
||||||
void (*userFunc)(struct remote_ls_ctx *ls),
|
void (*userFunc)(struct remote_ls_ctx *ls),
|
||||||
void *userData)
|
void *userData)
|
||||||
|
|
Loading…
Reference in a new issue