diff options
| author | Patrick Steinhardt <ps@pks.im> | 2024-10-07 06:38:21 +0200 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2024-10-07 15:08:11 -0700 |
| commit | ecb5c4318cd8b5bbb72f943b6128fe946ffcb56e (patch) | |
| tree | ebc6d28a99acd59267d413d1c1f4a6b06847f1e9 | |
| parent | 2be7fc012e6747160b4b6586a1ec209598581ade (diff) | |
| download | git-ecb5c4318cd8b5bbb72f943b6128fe946ffcb56e.tar.gz | |
unpack-trees: detect mismatching number of cache-tree/index entries
Same as the preceding commit, we unconditionally dereference the index's
cache entries depending on the number of cache-tree entries, which can
lead to a segfault when the cache-tree is corrupted. Fix this bug.
This also makes t4058 pass with the leak sanitizer enabled.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
| -rwxr-xr-x | t/t4058-diff-duplicates.sh | 7 | ||||
| -rw-r--r-- | unpack-trees.c | 2 |
2 files changed, 7 insertions, 2 deletions
diff --git a/t/t4058-diff-duplicates.sh b/t/t4058-diff-duplicates.sh index 3f602adb05..18e5ac88c3 100755 --- a/t/t4058-diff-duplicates.sh +++ b/t/t4058-diff-duplicates.sh @@ -10,6 +10,8 @@ # that the diff output isn't wildly unreasonable. test_description='test tree diff when trees have duplicate entries' + +TEST_PASSES_SANITIZE_LEAK=true . ./test-lib.sh # make_tree_entry <mode> <mode> <sha1> @@ -143,11 +145,12 @@ test_expect_success 'reset --hard does not segfault' ' test_grep "error: corrupted cache-tree has entries not present in index" err ' -test_expect_failure 'git diff HEAD does not segfault' ' +test_expect_success 'git diff HEAD does not segfault' ' git checkout base && GIT_TEST_CHECK_CACHE_TREE=false && git reset --hard && - test_might_fail git diff HEAD + test_must_fail git diff HEAD 2>err && + test_grep "error: corrupted cache-tree has entries not present in index" err ' test_expect_failure 'can switch to another branch when status is empty' ' diff --git a/unpack-trees.c b/unpack-trees.c index 21cc197d47..e10a9d1209 100644 --- a/unpack-trees.c +++ b/unpack-trees.c @@ -808,6 +808,8 @@ static int traverse_by_cache_tree(int pos, int nr_entries, int nr_names, if (!o->merge) BUG("We need cache-tree to do this optimization"); + if (nr_entries + pos > o->src_index->cache_nr) + return error(_("corrupted cache-tree has entries not present in index")); /* * Do what unpack_callback() and unpack_single_entry() normally |