gc: fix cast in compare_tasks_by_selection()

rscharfe · gitster · commit a1c74791d5ff · 2020-11-18T14:15:58.000-08:00
compare_tasks_by_selection() is used with QSORT and gets passed pointers
to the elements of "static struct maintenance_task tasks[]".  It casts
the *addresses* of these passed pointers to element pointers, though,
and thus effectively compares some unrelated values from the stack.  Fix
the casts to actually compare array elements.

Detected by USan (make SANITIZE=undefined test).

Signed-off-by: René Scharfe &lt;l.s.r@web.de&gt;
Signed-off-by: Junio C Hamano &lt;gitster@pobox.com&gt;
diff --git a/builtin/gc.c b/builtin/gc.c
@@ -1253,10 +1253,8 @@ static struct maintenance_task tasks[] = {
 
 static int compare_tasks_by_selection(const void *a_, const void *b_)
 {
-	const struct maintenance_task *a, *b;
-
-	a = (const struct maintenance_task *)&a_;
-	b = (const struct maintenance_task *)&b_;
+	const struct maintenance_task *a = a_;
+	const struct maintenance_task *b = b_;
 
 	return b->selected_order - a->selected_order;
 }

Original file line number	Diff line number	Diff line change
`@@ -1253,10 +1253,8 @@ static struct maintenance_task tasks[] = {`
`1253`	`1253`
`1254`	`1254`	`static int compare_tasks_by_selection(const void a_, const void b_)`
`1255`	`1255`	`{`
`1256`		`- const struct maintenance_task a, b;`
`1257`		`-`
`1258`		`- a = (const struct maintenance_task *)&a_;`
`1259`		`- b = (const struct maintenance_task *)&b_;`
	`1256`	`+ const struct maintenance_task *a = a_;`
	`1257`	`+ const struct maintenance_task *b = b_;`
`1260`	`1258`
`1261`	`1259`	`return b->selected_order - a->selected_order;`
`1262`	`1260`	`}`