Re: Segmentation fault in git apply

[Junio C Hamano <gitster@pobox.com>]

"Kyle J. McKay" <mackyle@gmail.com> writes:

> If I make this change on top of 250b3c6c:
>
> diff --git a/builtin/apply.c b/builtin/apply.c
> index df773c75..8795e830 100644
> --- a/builtin/apply.c
> +++ b/builtin/apply.c
> @@ -2390,6 +2390,8 @@ static int match_fragment(struct image *img,
>  	fixed_buf = strbuf_detach(&fixed, &fixed_len);
>  	if (postlen < postimage->len)
>  		postlen = 0;
> +	if (postlen)
> +		postlen = 2 * postimage->len;
>  	update_pre_post_images(preimage, postimage,
>  			       fixed_buf, fixed_len, postlen);
>  	return 1;
>
> Then the problem goes away.  That seems to suggest that postlen is
> being computed incorrectly, but someone more familiar with
> bulitin/apply.c is going to need to look at it.

Indeed, with this, the test case detects under-counting in the
caller (the caller counts 262 bytes but the expansion consumes 273
bytes).

-- >8 --
Subject: apply: make update_pre_post_images() sanity check the given postlen

---
 builtin/apply.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/builtin/apply.c b/builtin/apply.c
index 622ee16..18b7997 100644
--- a/builtin/apply.c
+++ b/builtin/apply.c
@@ -2174,6 +2174,10 @@ static void update_pre_post_images(struct image *preimage,
 	/* Fix the length of the whole thing */
 	postimage->len = new - postimage->buf;
 	postimage->nr -= reduced;
+
+	if (postlen && postlen < (new - postimage->buf))
+		die("BUG: postlen = %d, used = %d",
+		    (int)postlen, (int)(new - postimage->buf));
 }
 
 static int match_fragment(struct image *img,
-- 
2.3.0-rc0-149-g0286818