From 3d8c7a57903f91decd5e6c531974a1af1aaa3c97 Mon Sep 17 00:00:00 2001 From: Petr Baudis Date: Tue, 12 Apr 2005 14:37:42 -0700 Subject: [PATCH] [PATCH] Fix a crash when doing rev-tree In parse_commit(), free(buffer) is fed a bogus pointer. Signed-off-by: Petr Baudis Signed-off-by: Linus Torvalds --- rev-tree.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/rev-tree.c b/rev-tree.c index 82bf5aaf9..f2414b20f 100644 --- a/rev-tree.c +++ b/rev-tree.c @@ -152,22 +152,22 @@ static int parse_commit(unsigned char *sha1) struct revision *rev = lookup_rev(sha1); if (!(rev->flags & SEEN)) { - void *buffer; + void *buffer, *bufptr; unsigned long size; char type[20]; unsigned char parent[20]; rev->flags |= SEEN; - buffer = read_sha1_file(sha1, type, &size); + buffer = bufptr = read_sha1_file(sha1, type, &size); if (!buffer || strcmp(type, "commit")) return -1; - buffer += 46; /* "tree " + "hex sha1" + "\n" */ - while (!memcmp(buffer, "parent ", 7) && !get_sha1_hex(buffer+7, parent)) { + bufptr += 46; /* "tree " + "hex sha1" + "\n" */ + while (!memcmp(bufptr, "parent ", 7) && !get_sha1_hex(bufptr+7, parent)) { add_relationship(rev, parent); parse_commit(parent); - buffer += 48; /* "parent " + "hex sha1" + "\n" */ + bufptr += 48; /* "parent " + "hex sha1" + "\n" */ } - rev->date = parse_commit_date(buffer); + rev->date = parse_commit_date(bufptr); free(buffer); } return 0; -- 2.26.2