From 5743350f696745a48dfe7976c98dc8eb5c842d72 Mon Sep 17 00:00:00 2001 From: Jim Meyering Date: Thu, 26 May 2011 15:54:18 +0200 Subject: [PATCH] rerere.c: diagnose a corrupt MERGE_RR when hitting EOF between TAB and '\0' If we reach EOF after the SHA1-then-TAB, yet before the NUL that terminates each file name, we would fill the file name buffer with \255 bytes resulting from the repeatedly-failing fgetc (returns EOF/-1) and ultimately complain about "filename too long", because no NUL was encountered. Signed-off-by: Jim Meyering Signed-off-by: Junio C Hamano --- rerere.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/rerere.c b/rerere.c index d260843475..283a0024b0 100644 --- a/rerere.c +++ b/rerere.c @@ -42,8 +42,14 @@ static void read_rr(struct string_list *rr) name = xstrdup(buf); if (fgetc(in) != '\t') die("corrupt MERGE_RR"); - for (i = 0; i < sizeof(buf) && (buf[i] = fgetc(in)); i++) - ; /* do nothing */ + for (i = 0; i < sizeof(buf); i++) { + int c = fgetc(in); + if (c < 0) + die("corrupt MERGE_RR"); + buf[i] = c; + if (c == 0) + break; + } if (i == sizeof(buf)) die("filename too long"); string_list_insert(rr, buf)->util = name;