Merge branch 'ax/line-log-range-merge-fix' into maint
authorJunio C Hamano <gitster@pobox.com>
Thu, 16 Mar 2017 20:56:42 +0000 (13:56 -0700)
committerJunio C Hamano <gitster@pobox.com>
Thu, 16 Mar 2017 20:56:42 +0000 (13:56 -0700)
The code to parse "git log -L..." command line was buggy when there
are many ranges specified with -L; overrun of the allocated buffer
has been fixed.

* ax/line-log-range-merge-fix:
  line-log.c: prevent crash during union of too many ranges

1  2 
line-log.c

diff --combined line-log.c
@@@ -113,7 -113,7 +113,7 @@@ void sort_and_merge_range_set(struct ra
        int i;
        int o = 0; /* output cursor */
  
 -      qsort(rs->ranges, rs->nr, sizeof(struct range), range_cmp);
 +      QSORT(rs->ranges, rs->nr, range_cmp);
  
        for (i = 0; i < rs->nr; i++) {
                if (rs->ranges[i].start == rs->ranges[i].end)
  static void range_set_union(struct range_set *out,
                             struct range_set *a, struct range_set *b)
  {
-       int i = 0, j = 0, o = 0;
+       int i = 0, j = 0;
        struct range *ra = a->ranges;
        struct range *rb = b->ranges;
        /* cannot make an alias of out->ranges: it may change during grow */
                        new = &rb[j++];
                if (new->start == new->end)
                        ; /* empty range */
-               else if (!o || out->ranges[o-1].end < new->start) {
+               else if (!out->nr || out->ranges[out->nr-1].end < new->start) {
                        range_set_grow(out, 1);
-                       out->ranges[o].start = new->start;
-                       out->ranges[o].end = new->end;
-                       o++;
-               } else if (out->ranges[o-1].end < new->end) {
-                       out->ranges[o-1].end = new->end;
+                       out->ranges[out->nr].start = new->start;
+                       out->ranges[out->nr].end = new->end;
+                       out->nr++;
+               } else if (out->ranges[out->nr-1].end < new->end) {
+                       out->ranges[out->nr-1].end = new->end;
                }
        }
-       out->nr = o;
  }
  
  /*