Andrew's git
/
gitweb.git
/ diff
summary
|
log
|
commit
| diff |
tree
commit
grep
author
committer
pickaxe
?
re
format_sanitized_subject: Don't trim past initial length of strbuf
author
Stephen Boyd
<bebarino@gmail.com>
Tue, 31 Mar 2009 23:24:38 +0000
(16:24 -0700)
committer
Junio C Hamano
<gitster@pobox.com>
Wed, 1 Apr 2009 18:05:31 +0000
(11:05 -0700)
If the subject line is '...' the strbuf will be accessed before the
first dot is added; potentially changing the strbuf passed into the
function or accessing sb->buf[-1] if it was originally empty.
Reported-by: René Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
pretty.c
patch
|
blob
|
history
raw
|
patch
|
inline
| side by side (parent:
b09b868
)
diff --git
a/pretty.c
b/pretty.c
index c57cef47c93912a709fc67fe98cdcff15ed34dc6..a0ef356558f4cdb148010f1b47dbd3fcc363d8ba 100644
(file)
--- a/
pretty.c
+++ b/
pretty.c
@@
-502,6
+502,7
@@
static int istitlechar(char c)
static void format_sanitized_subject(struct strbuf *sb, const char *msg)
{
size_t trimlen;
static void format_sanitized_subject(struct strbuf *sb, const char *msg)
{
size_t trimlen;
+ size_t start_len = sb->len;
int space = 2;
for (; *msg && *msg != '\n'; msg++) {
int space = 2;
for (; *msg && *msg != '\n'; msg++) {
@@
-519,8
+520,9
@@
static void format_sanitized_subject(struct strbuf *sb, const char *msg)
/* trim any trailing '.' or '-' characters */
trimlen = 0;
/* trim any trailing '.' or '-' characters */
trimlen = 0;
- while (sb->buf[sb->len - 1 - trimlen] == '.'
- || sb->buf[sb->len - 1 - trimlen] == '-')
+ while (sb->len - trimlen > start_len &&
+ (sb->buf[sb->len - 1 - trimlen] == '.'
+ || sb->buf[sb->len - 1 - trimlen] == '-'))
trimlen++;
strbuf_remove(sb, sb->len - trimlen, trimlen);
}
trimlen++;
strbuf_remove(sb, sb->len - trimlen, trimlen);
}