From: Thomas Gummerer <t.gummerer@gmail.com>
To: git@vger.kernel.org
Cc: Derrick Stolee <stolee@gmail.com>,
Thomas Gummerer <t.gummerer@gmail.com>
Subject: [PATCH] commit-reach: fix sorting commits by generation
Date: Mon, 22 Oct 2018 22:10:37 +0100 [thread overview]
Message-ID: <20181022211037.22719-1-t.gummerer@gmail.com> (raw)
compare_commit_by_gen is used to sort a list of pointers to 'struct
commit'. The comparison function for qsort is called with pointers to
the objects it needs to compare, so when sorting a list of 'struct
commit *', the arguments are of type 'struct commit **'. However,
currently the comparison function casts it's arguments to 'struct
commit *' and uses those, leading to out of bounds memory access and
potentially to wrong results. Fix that.
Signed-off-by: Thomas Gummerer <t.gummerer@gmail.com>
---
I noticed this by running the test suite through valgrind. I'm not
familiar with this code, so I'm not sure why this didn't cause any
issues or how they would manifest, but this seems like the right fix
for this function either way.
commit-reach.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/commit-reach.c b/commit-reach.c
index bc522d6840..9efddfd7a0 100644
--- a/commit-reach.c
+++ b/commit-reach.c
@@ -516,8 +516,8 @@ int commit_contains(struct ref_filter *filter, struct commit *commit,
static int compare_commits_by_gen(const void *_a, const void *_b)
{
- const struct commit *a = (const struct commit *)_a;
- const struct commit *b = (const struct commit *)_b;
+ const struct commit *a = *(const struct commit **)_a;
+ const struct commit *b = *(const struct commit **)_b;
if (a->generation < b->generation)
return -1;
--
2.19.1.759.g500967bb5e
next reply other threads:[~2018-10-22 21:10 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-22 21:10 Thomas Gummerer [this message]
2018-10-22 21:53 ` [PATCH] commit-reach: fix sorting commits by generation René Scharfe
2018-10-23 20:32 ` Thomas Gummerer
2018-10-24 13:19 ` Derrick Stolee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181022211037.22719-1-t.gummerer@gmail.com \
--to=t.gummerer@gmail.com \
--cc=git@vger.kernel.org \
--cc=stolee@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).