From: Junio C Hamano <gitster@pobox.com>
Date: Mon, 13 Mar 2017 06:21:34 +0000 (-0700)
Subject: Merge branch 'ax/line-log-range-merge-fix'
X-Git-Tag: v2.13.0-rc0~128
X-Git-Url: https://git.lorimer.id.au/gitweb.git/diff_plain/36d5286f6815542761dae92fdcdce8db1556727f?ds=inline;hp=-c

Merge branch 'ax/line-log-range-merge-fix'

The code to parse "git log -L..." command line was buggy when there
are many ranges specified with -L; overrun of the allocated buffer
has been fixed.

* ax/line-log-range-merge-fix:
line-log.c: prevent crash during union of too many ranges
---

36d5286f6815542761dae92fdcdce8db1556727f
diff --combined line-log.c
index 65f3558b3b,47eaba73c6..9510296659
--- a/line-log.c
+++ b/line-log.c
@@@ -113,7 -113,7 +113,7 @@@ void sort_and_merge_range_set(struct ra
  	int i;
  	int o = 0; /* output cursor */
  
 -	qsort(rs->ranges, rs->nr, sizeof(struct range), range_cmp);
 +	QSORT(rs->ranges, rs->nr, range_cmp);
  
  	for (i = 0; i < rs->nr; i++) {
  		if (rs->ranges[i].start == rs->ranges[i].end)
@@@ -144,7 -144,7 +144,7 @@@
  static void range_set_union(struct range_set *out,
  			     struct range_set *a, struct range_set *b)
  {
- 	int i = 0, j = 0, o = 0;
+ 	int i = 0, j = 0;
  	struct range *ra = a->ranges;
  	struct range *rb = b->ranges;
  	/* cannot make an alias of out->ranges: it may change during grow */
@@@ -167,16 -167,15 +167,15 @@@
  			new = &rb[j++];
  		if (new->start == new->end)
  			; /* empty range */
- 		else if (!o || out->ranges[o-1].end < new->start) {
+ 		else if (!out->nr || out->ranges[out->nr-1].end < new->start) {
  			range_set_grow(out, 1);
- 			out->ranges[o].start = new->start;
- 			out->ranges[o].end = new->end;
- 			o++;
- 		} else if (out->ranges[o-1].end < new->end) {
- 			out->ranges[o-1].end = new->end;
+ 			out->ranges[out->nr].start = new->start;
+ 			out->ranges[out->nr].end = new->end;
+ 			out->nr++;
+ 		} else if (out->ranges[out->nr-1].end < new->end) {
+ 			out->ranges[out->nr-1].end = new->end;
  		}
  	}
- 	out->nr = o;
  }
  
  /*