diff options
| author | Jim Meyering <jim@meyering.net> | 2011-05-20 19:20:12 +0200 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2011-05-20 11:39:49 -0700 |
| commit | 42536dd9b9829b4eb4e3706e141b3c8bffa3e826 (patch) | |
| tree | db640fa331f2b513c593eda286400c2086c9ec5a /t | |
| parent | 5269edf1702b7375a287d5bbbb3c1b1f3a8aa765 (diff) | |
| download | git-42536dd9b9829b4eb4e3706e141b3c8bffa3e826.tar.gz git-42536dd9b9829b4eb4e3706e141b3c8bffa3e826.tar.xz | |
do not read beyond end of malloc'd buffer
With diff.suppress-blank-empty=true, "git diff --word-diff" would
output data that had been read from uninitialized heap memory.
The problem was that fn_out_consume did not account for the
possibility of a line with length 1, i.e., the empty context line
that diff.suppress-blank-empty=true converts from " \n" to "\n".
Since it assumed there would always be a prefix character (the space),
it decremented "len" unconditionally, thus passing len=0 to emit_line,
which would then blindly call emit_line_0 with len=-1 which would
pass that value on to fwrite as SIZE_MAX. Boom.
Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 't')
| -rwxr-xr-x | t/t4034-diff-words.sh | 26 |
1 files changed, 26 insertions, 0 deletions
diff --git a/t/t4034-diff-words.sh b/t/t4034-diff-words.sh index 37aeab0d5..c374aa4c1 100755 --- a/t/t4034-diff-words.sh +++ b/t/t4034-diff-words.sh @@ -307,4 +307,30 @@ test_language_driver python test_language_driver ruby test_language_driver tex +test_expect_success 'word-diff with diff.sbe' ' + cat >expect <<-\EOF && + diff --git a/pre b/post + index a1a53b5..bc8fe6d 100644 + --- a/pre + +++ b/post + @@ -1,3 +1,3 @@ + a + + [-b-]{+c+} + EOF + cat >pre <<-\EOF && + a + + b + EOF + cat >post <<-\EOF && + a + + c + EOF + test_when_finished "git config --unset diff.suppress-blank-empty" && + git config diff.suppress-blank-empty true && + word_diff --word-diff=plain +' + test_done |