Fix users of prefix_path() to free() only when necessary

Unfortunately, prefix_path() sometimes returns a newly xmalloc()ed buffer,
and in other cases it returns a substring!

For example, when calling

git update-index ./hello.txt

prefix_path() returns "hello.txt", but does not allocate a new buffer. The
original code only checked if the result of prefix_path() was different from
what was passed in, and thusly trigger a segmentation fault.

Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>

diff --git a/checkout-index.c b/checkout-index.c
index 0b9cabc61cafa06501064c0b2cccbc3d434904c2..cc3a745c149b38ae250ac5656bb4a4843a95f6a4 100644 (file)
--- a/checkout-index.c
+++ b/checkout-index.c
@@ -277,7 +277,7 @@ int main(int argc, char **argv)
                        die("git-checkout-index: don't mix '--stdin' and explicit filenames");
                p = prefix_path(prefix, prefix_length, arg);
                checkout_file(p);
                        die("git-checkout-index: don't mix '--stdin' and explicit filenames");
                p = prefix_path(prefix, prefix_length, arg);
                checkout_file(p);

-               if (p != arg)
+               if (p < arg || p > arg + strlen(arg))

                        free((char*)p);
        }
 
                        free((char*)p);
        }
 


@@ -299,7 +299,7 @@ int main(int argc, char **argv)
                                path_name = buf.buf;
                        p = prefix_path(prefix, prefix_length, path_name);
                        checkout_file(p);
                                path_name = buf.buf;
                        p = prefix_path(prefix, prefix_length, path_name);
                        checkout_file(p);

-                       if (p != path_name)
+                       if (p < path_name || p > path_name + strlen(path_name))

                                free((char *)p);
                        if (path_name != buf.buf)
                                free(path_name);
                                free((char *)p);
                        if (path_name != buf.buf)
                                free(path_name);

diff --git a/update-index.c b/update-index.c
index d63f8ac99820ad3984a780e9772c77bef7c7225b..00cde706459936daf4da371404b8e313a95f9649 100644 (file)
--- a/update-index.c
+++ b/update-index.c
@@ -382,7 +382,7 @@ static void update_one(const char *path, const char *prefix, int prefix_length)
                die("Unable to process file %s", path);
        report("add '%s'", path);
  free_return:
                die("Unable to process file %s", path);
        report("add '%s'", path);
  free_return:

-       if (p != path)
+       if (p < path || p > path + strlen(path))

                free((char*)p);
 }
 
                free((char*)p);
 }
 


@@ -594,7 +594,7 @@ static int do_unresolve(int ac, const char **av,
                const char *arg = av[i];
                const char *p = prefix_path(prefix, prefix_length, arg);
                err |= unresolve_one(p);
                const char *arg = av[i];
                const char *p = prefix_path(prefix, prefix_length, arg);
                err |= unresolve_one(p);

-               if (p != arg)
+               if (p < arg || p > arg + strlen(arg))

                        free((char*)p);
        }
        return err;
                        free((char*)p);
        }
        return err;


@@ -750,7 +750,7 @@ int main(int argc, const char **argv)
                        update_one(p, NULL, 0);
                        if (set_executable_bit)
                                chmod_path(set_executable_bit, p);
                        update_one(p, NULL, 0);
                        if (set_executable_bit)
                                chmod_path(set_executable_bit, p);

-                       if (p != path_name)
+                       if (p < path_name || p > path_name + strlen(path_name))

                                free((char*) p);
                        if (path_name != buf.buf)
                                free(path_name);
                                free((char*) p);
                        if (path_name != buf.buf)
                                free(path_name);