|
2008-10-26
| ||
| 02:29 | • Fixed ticket [41bb23e650]: win32 fossil commit stops if many files added or edited. plus 2 other changes ... (artifact: b56d4bcf6e user: drh) | |
| 02:29 | Prevent buffer overrun when adding \r characters to the check-in descriptions for win32. Ticket [41bb23e650]. ... (check-in: e44d7a4b5a user: drh tags: trunk) | |
|
2008-10-24
| ||
| 06:42 | • New ticket [41bb23e650] win32 fossil commit stops if many files added or edited.. ... (artifact: aaf3bac075 user: anonymous) | |
| Ticket Hash: | 41bb23e65002895e71d5ff1670f2e72037d82678 | |||
| Title: | win32 fossil commit stops if many files added or edited. | |||
| Status: | Fixed | Type: | Code_Defect | |
| Severity: | Minor | Priority: | Immediate | |
| Subsystem: | Resolution: | Open | ||
| Last Modified: | 2008-10-26 02:29:47 | |||
| Version Found In: | a1f727be9d | |||
| Description: | ||||
|
'blob_add_cr()' has buffer overrun if it requires to call 'blob_resize()'
(declared in "blob.c") 'blob_add_cr()' increase 'Blob#nUsed' if Blob includes '\n'. and 'blob_resize()' update it, too. then it makes buffer overrun. here is my replacement void blob_add_cr(Blob *p){
char *z = p->aData;
int j = p->nUsed;
int i, n;
for(i=n=0; i<j; i++){
if( z[i]=='\n' ) n++;
}
j += n;
if( j>=p->nAlloc ){
blob_resize(p, j);
z = p->aData;
}
p->nUsed = j;
z[j] = 0;
while( j>i ){
if( (z[--j] = z[--i]) =='\n' ){
z[--j] = '\r';
}
}
}
| ||||