From a4fddb01c5bd0ecbd5e297ee571ad29ca62bf940 Mon Sep 17 00:00:00 2001 From: Vaidas Pilkauskas Date: Tue, 17 Mar 2026 13:00:34 +0000 Subject: [PATCH] strbuf_attach: fix call sites to pass correct alloc strbuf_attach(sb, buf, len, alloc) requires alloc > len (the buffer must have at least len+1 bytes to hold the NUL). Several call sites passed alloc == len, relying on strbuf_grow(sb, 0) inside strbuf_attach to reallocate. Fix these in mailinfo, am, refs/files-backend, fast-import, and trailer by passing len+1 when the buffer is a NUL-terminated string (or from strbuf_detach). Signed-off-by: Vaidas Pilkauskas Signed-off-by: Junio C Hamano --- builtin/am.c | 2 +- builtin/fast-import.c | 2 +- mailinfo.c | 2 +- refs/files-backend.c | 2 +- trailer.c | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/builtin/am.c b/builtin/am.c index b66a33d8a8..66be33ab42 100644 --- a/builtin/am.c +++ b/builtin/am.c @@ -1188,7 +1188,7 @@ static void am_append_signoff(struct am_state *state) { struct strbuf sb = STRBUF_INIT; - strbuf_attach(&sb, state->msg, state->msg_len, state->msg_len); + strbuf_attach(&sb, state->msg, state->msg_len, state->msg_len + 1); append_signoff(&sb, 0, 0); state->msg = strbuf_detach(&sb, &state->msg_len); } diff --git a/builtin/fast-import.c b/builtin/fast-import.c index b8a7757cfd..164d8a6198 100644 --- a/builtin/fast-import.c +++ b/builtin/fast-import.c @@ -3246,7 +3246,7 @@ static void cat_blob(struct object_entry *oe, struct object_id *oid) cat_blob_write("\n", 1); if (oe && oe->pack_id == pack_id) { last_blob.offset = oe->idx.offset; - strbuf_attach(&last_blob.data, buf, size, size); + strbuf_attach(&last_blob.data, buf, size, size + 1); last_blob.depth = oe->depth; } else free(buf); diff --git a/mailinfo.c b/mailinfo.c index 99ac596e09..e52a35fde0 100644 --- a/mailinfo.c +++ b/mailinfo.c @@ -470,7 +470,7 @@ static int convert_to_utf8(struct mailinfo *mi, return error("cannot convert from %s to %s", charset, mi->metainfo_charset); } - strbuf_attach(line, out, out_len, out_len); + strbuf_attach(line, out, out_len, out_len + 1); return 0; } diff --git a/refs/files-backend.c b/refs/files-backend.c index 240d3c3b26..bddc04099d 100644 --- a/refs/files-backend.c +++ b/refs/files-backend.c @@ -1806,7 +1806,7 @@ static int commit_ref(struct ref_lock *lock) size_t len = strlen(path); struct strbuf sb_path = STRBUF_INIT; - strbuf_attach(&sb_path, path, len, len); + strbuf_attach(&sb_path, path, len, len + 1); /* * If this fails, commit_lock_file() will also fail diff --git a/trailer.c b/trailer.c index 911a81ed99..3afe368db0 100644 --- a/trailer.c +++ b/trailer.c @@ -1009,7 +1009,7 @@ static struct trailer_block *trailer_block_get(const struct process_trailer_opti for (ptr = trailer_lines; *ptr; ptr++) { if (last && isspace((*ptr)->buf[0])) { struct strbuf sb = STRBUF_INIT; - strbuf_attach(&sb, *last, strlen(*last), strlen(*last)); + strbuf_attach(&sb, *last, strlen(*last), strlen(*last) + 1); strbuf_addbuf(&sb, *ptr); *last = strbuf_detach(&sb, NULL); continue;