1. 08 2月, 2009 3 次提交
  2. 05 2月, 2009 4 次提交
  3. 04 2月, 2009 4 次提交
  4. 03 2月, 2009 1 次提交
  5. 01 2月, 2009 1 次提交
    • R
      merge: fix out-of-bounds memory access · c7cddc1a
      René Scharfe 提交于
      The parameter n of unpack_callback() can have a value of up to
      MAX_UNPACK_TREES.  The check at the top of unpack_trees() (its only
      (indirect) caller) makes sure it cannot exceed this limit.
      
      unpack_callback() passes it and the array src to unpack_nondirectories(),
      which has this loop:
      
      	for (i = 0; i < n; i++) {
      		/* ... */
      		src[i + o->merge] = o->df_conflict_entry;
      
      o->merge can be 0 or 1, so unpack_nondirectories() potentially accesses
      the array src at index MAX_UNPACK_TREES.  This patch makes it big enough.
      Reported-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NRené Scharfe <rene.scharfe@lsrfire.ath.cx>
      Signed-off-by: NJunio C Hamano <gitster@pobox.com>
      c7cddc1a
  6. 29 1月, 2009 1 次提交
  7. 28 1月, 2009 2 次提交
  8. 23 1月, 2009 1 次提交
  9. 18 1月, 2009 4 次提交
  10. 16 1月, 2009 3 次提交
  11. 15 1月, 2009 2 次提交
  12. 14 1月, 2009 2 次提交
  13. 13 1月, 2009 2 次提交
  14. 07 1月, 2009 2 次提交
  15. 22 12月, 2008 1 次提交
  16. 20 12月, 2008 7 次提交