line-log: use COPY_ARRAY to fix mis-sized memcpy
authorVegard Nossum <vegard.nossum@oracle.com>
Sun, 5 Mar 2017 11:44:46 +0000 (06:44 -0500)
committerJunio C Hamano <gitster@pobox.com>
Mon, 6 Mar 2017 20:01:02 +0000 (12:01 -0800)
This memcpy meant to get the sizeof a "struct range", not a
"range_set", as the former is what our array holds. Rather
than swap out the types, let's convert this site to
COPY_ARRAY, which avoids the problem entirely (and confirms
that the src and dst types match).

Note for curiosity's sake that this bug doesn't trigger on
I32LP64 systems, but does on ILP32 systems. The mistaken
"struct range_set" has two ints and a pointer. That's 16
bytes on LP64, or 12 on ILP32. The correct "struct range"
type has two longs, which is also 16 on LP64, but only 8 on
ILP32.

Likewise an IL32P64 system would experience the bug.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
line-log.c
index 916e7248701dad2a8beb870887a5ed7d3874ff41..df83ede12f3da8a9c533d1afaabb19ab7a7e4a64 100644 (file)
@@ -43,9 +43,10 @@ void range_set_release(struct range_set *rs)
 static void range_set_copy(struct range_set *dst, struct range_set *src)
 {
        range_set_init(dst, src->nr);
-       memcpy(dst->ranges, src->ranges, src->nr*sizeof(struct range_set));
+       COPY_ARRAY(dst->ranges, src->ranges, src->nr);
        dst->nr = src->nr;
 }
+
 static void range_set_move(struct range_set *dst, struct range_set *src)
 {
        range_set_release(dst);