aboutsummaryrefslogtreecommitdiff
path: root/xdiff
diff options
context:
space:
mode:
authorMichael Haggerty <mhagger@alum.mit.edu>2016-08-22 13:22:40 +0200
committerJunio C Hamano <gitster@pobox.com>2016-08-23 13:51:47 -0700
commita8fd78cc53456ec6831436690eba06b36093ed7e (patch)
tree8897f9dcab4883773405e752748b006eb085fc6d /xdiff
parent054d949ffb2e3aa98a97c564dc9c260e7fbab033 (diff)
downloadgit-a8fd78cc53456ec6831436690eba06b36093ed7e.tar.gz
git-a8fd78cc53456ec6831436690eba06b36093ed7e.tar.xz
xdl_change_compact(): fix compaction heuristic to adjust ixo
The code branch used for the compaction heuristic forgot to keep ixo in sync while the group was shifted. This is certainly wrong, as it causes the two counters to get out of sync. I *think* that this bug could also have caused the function to read past the end of the rchgo array, though I haven't done the work to prove it for sure. Here is my reasoning: If ixo is not decremented correctly during one iteration of the outer while loop, then it will loose sync with the ix counter. In particular, ixo will be too large. Suppose that the next iterations of the outer while loop (i.e., processing the next block of add/delete lines) don't have any sliders. Then the ixo counter would be incremented by the number of non-changed lines in xdf, which is the same as the number of non-changed lines in xdfo that *should have* followed the group that experienced the malfunction. But since ixo was too large at the end of that iteration, it will be incremented past the end of the xdfo->rchg array, and will try to read that memory illegally. Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'xdiff')
-rw-r--r--xdiff/xdiffi.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/xdiff/xdiffi.c b/xdiff/xdiffi.c
index b3c684887..95b037ee3 100644
--- a/xdiff/xdiffi.c
+++ b/xdiff/xdiffi.c
@@ -528,6 +528,7 @@ int xdl_change_compact(xdfile_t *xdf, xdfile_t *xdfo, long flags) {
recs_match(recs, ixs - 1, ix - 1, flags)) {
rchg[--ixs] = 1;
rchg[--ix] = 0;
+ while (rchgo[--ixo]);
}
}
}