global/git
1
0
Fork 0
mirror of https://github.com/git/git.git synced 2026-01-25 18:12:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

difftool: fix use-after-free

Browse Source 
The left and right base directories were pointed to the buf field of
two strbufs, which were subject to change.

Let's just copy the strings and be done with it.

This fixes https://github.com/git-for-windows/git/issues/1124

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
This commit is contained in:
Johannes Schindelin
2017-04-05 13:24:41 +02:00
parent e07d7179b0
commit 7723f38cfb
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
builtin/difftool.c
View File

@@ -262,6 +262,7 @@ static int run_dir_diff(const char *extcmd, int symlinks, const char *prefix,
struct strbuf rpath = STRBUF_INIT, buf = STRBUF_INIT;
struct strbuf ldir = STRBUF_INIT, rdir = STRBUF_INIT;
struct strbuf wtdir = STRBUF_INIT;
char *lbase_dir, *rbase_dir;
size_t ldir_len, rdir_len, wtdir_len;
struct cache_entry *ce = xcalloc(1, sizeof(ce) + PATH_MAX + 1);
const char *workdir, *tmp;
@@ -298,11 +299,11 @@ static int run_dir_diff(const char *extcmd, int symlinks, const char *prefix,
memset(&wtindex, 0, sizeof(wtindex));
memset(&lstate, 0, sizeof(lstate));
lstate.base_dir = ldir.buf;
lstate.base_dir = lbase_dir = xstrdup(ldir.buf);
lstate.base_dir_len = ldir.len;
lstate.force = 1;
memset(&rstate, 0, sizeof(rstate));
rstate.base_dir = rdir.buf;
rstate.base_dir = rbase_dir = xstrdup(rdir.buf);
rstate.base_dir_len = rdir.len;
rstate.force = 1;
@@ -585,6 +586,8 @@ static int run_dir_diff(const char *extcmd, int symlinks, const char *prefix,
finish:
free(ce);
free(lbase_dir);
free(rbase_dir);
strbuf_release(&ldir);
strbuf_release(&rdir);
strbuf_release(&wtdir);