http-push: fix off-by-path_len

dscho · gitster · commit 20642801e44a · 2009-01-17T18:19:35.000-08:00
When getting the result of remote_ls(), we were advancing the variable
"path" to the relative path inside the repository.

However, then we went on to malloc a bogus amount of memory: we were
subtracting the prefix length _again_, quite possibly getting something
negative, which xmalloc() interprets as really, really much.

Signed-off-by: Johannes Schindelin &lt;johannes.schindelin@gmx.de&gt;
Signed-off-by: Junio C Hamano &lt;gitster@pobox.com&gt;
diff --git a/http-push.c b/http-push.c
@@ -1434,10 +1434,8 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
 			}
 			if (path) {
 				path += remote->path_len;
+				ls->dentry_name = xstrdup(path);
 			}
-			ls->dentry_name = xmalloc(strlen(path) -
-						  remote->path_len + 1);
-			strcpy(ls->dentry_name, path + remote->path_len);
 		} else if (!strcmp(ctx->name, DAV_PROPFIND_COLLECTION)) {
 			ls->dentry_flags |= IS_DIR;
 		}
@@ -1448,6 +1446,12 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)
 	}
 }
 
+/*
+ * NEEDSWORK: remote_ls() ignores info/refs on the remote side.  But it
+ * should _only_ heed the information from that file, instead of trying to
+ * determine the refs from the remote file system (badly: it does not even
+ * know about packed-refs).
+ */
 static void remote_ls(const char *path, int flags,
 		      void (*userFunc)(struct remote_ls_ctx *ls),
 		      void *userData)

Original file line number	Diff line number	Diff line change
`@@ -1434,10 +1434,8 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)`
`1434`	`1434`	`}`
`1435`	`1435`	`if (path) {`
`1436`	`1436`	`path += remote->path_len;`
	`1437`	`+ ls->dentry_name = xstrdup(path);`
`1437`	`1438`	`}`
`1438`		`- ls->dentry_name = xmalloc(strlen(path) -`
`1439`		`- remote->path_len + 1);`
`1440`		`- strcpy(ls->dentry_name, path + remote->path_len);`
`1441`	`1439`	`} else if (!strcmp(ctx->name, DAV_PROPFIND_COLLECTION)) {`
`1442`	`1440`	`ls->dentry_flags \|= IS_DIR;`
`1443`	`1441`	`}`
`@@ -1448,6 +1446,12 @@ static void handle_remote_ls_ctx(struct xml_ctx *ctx, int tag_closed)`
`1448`	`1446`	`}`
`1449`	`1447`	`}`
`1450`	`1448`
	`1449`	`+/*`
	`1450`	`+ * NEEDSWORK: remote_ls() ignores info/refs on the remote side. But it`
	`1451`	`+ * should _only_ heed the information from that file, instead of trying to`
	`1452`	`+ * determine the refs from the remote file system (badly: it does not even`
	`1453`	`+ * know about packed-refs).`
	`1454`	`+ */`
`1451`	`1455`	`static void remote_ls(const char *path, int flags,`
`1452`	`1456`	`void (userFunc)(struct remote_ls_ctx ls),`
`1453`	`1457`	`void *userData)`