[PATCH] Fix an infinite loop in sq_quote_buf().

[PATCH] Fix an infinite loop in sq_quote_buf().

[Johannes Sixt]

sq_quote_buf() treats single-quotes and exclamation marks specially, but
it incorrectly parsed the input for single-quotes and backslashes.

Signed-off-by: Johannes Sixt <johannes.sixt@telecom.at>
---
 quote.c          |    2 +-
 t/t5510-fetch.sh |    7 +++++++
 2 files changed, 8 insertions(+), 1 deletions(-)

diff --git a/quote.c b/quote.c
index 482be05..919d092 100644
--- a/quote.c
+++ b/quote.c
@@ -26,7 +26,7 @@ void sq_quote_buf(struct strbuf *dst, const char *src)
 
 	strbuf_addch(dst, '\'');
 	while (*src) {
-		size_t len = strcspn(src, "'\\");
+		size_t len = strcspn(src, "'!");
 		strbuf_add(dst, src, len);
 		src += len;
 		while (need_bs_quote(*src)) {
diff --git a/t/t5510-fetch.sh b/t/t5510-fetch.sh
index d217657..aad863d 100755
--- a/t/t5510-fetch.sh
+++ b/t/t5510-fetch.sh
@@ -208,4 +208,11 @@ test_expect_success 'fetch with a non-applying branch.<name>.merge' '
 	git fetch blub
 '
 
+# the strange name is: a\!'b
+test_expect_success 'quoting of a strangely named repo' '
+	! git fetch "a\\!'\''b" > result 2>&1 &&
+	cat result &&
+	grep "fatal: '\''a\\\\!'\''b'\''" result
+'
+
 test_done
-- 
1.5.3.4.315.g2ce38

Re: [PATCH] Fix an infinite loop in sq_quote_buf().

[Pierre Habouzit]

[-- Attachment #1: Type: text/plain, Size: 1024 bytes --]

On Sun, Nov 04, 2007 at 08:26:22PM +0000, Johannes Sixt wrote:
> sq_quote_buf() treats single-quotes and exclamation marks specially, but
> it incorrectly parsed the input for single-quotes and backslashes.
> 
> Signed-off-by: Johannes Sixt <johannes.sixt@telecom.at>
> ---
>  quote.c          |    2 +-
>  t/t5510-fetch.sh |    7 +++++++
>  2 files changed, 8 insertions(+), 1 deletions(-)
> 
> diff --git a/quote.c b/quote.c
> index 482be05..919d092 100644
> --- a/quote.c
> +++ b/quote.c
> @@ -26,7 +26,7 @@ void sq_quote_buf(struct strbuf *dst, const char *src)
>  
>  	strbuf_addch(dst, '\'');
>  	while (*src) {
> -		size_t len = strcspn(src, "'\\");
> +		size_t len = strcspn(src, "'!");
>  		strbuf_add(dst, src, len);
>  		src += len;
>  		while (need_bs_quote(*src)) {

  Ouch, good catch :/ sorry about that.

-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]