mirror of
https://github.com/git-for-windows/git.git
synced 2026-06-27 22:28:38 -05:00
reftable/basics: fix OOB read on binary search of empty range
`binsearch()` performs a binary search over a range of `sz` elements by repeatedly calling the comparison function with indices into that range. When the range is empty though, there is no valid index to call the comparison function with. We still end up executing the comparison function though with an index of 0, which of course will cause an out-of-bounds read. Return early when the range is empty. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
committed by
Junio C Hamano
parent
a4a83defdb
commit
d5040a8b2b
@@ -152,6 +152,9 @@ size_t binsearch(size_t sz, int (*f)(size_t k, void *args), void *args)
|
||||
size_t lo = 0;
|
||||
size_t hi = sz;
|
||||
|
||||
if (!sz)
|
||||
return 0;
|
||||
|
||||
/* Invariants:
|
||||
*
|
||||
* (hi == sz) || f(hi) == true
|
||||
|
||||
@@ -60,6 +60,17 @@ void test_reftable_basics__binsearch(void)
|
||||
}
|
||||
}
|
||||
|
||||
static int unreachable_lesseq(size_t i UNUSED, void *args UNUSED)
|
||||
{
|
||||
cl_fail("comparison function called for empty range");
|
||||
return 0;
|
||||
}
|
||||
|
||||
void test_reftable_basics__binsearch_empty(void)
|
||||
{
|
||||
cl_assert_equal_i(binsearch(0, &unreachable_lesseq, NULL), 0);
|
||||
}
|
||||
|
||||
void test_reftable_basics__names_length(void)
|
||||
{
|
||||
const char *a[] = { "a", "b", NULL };
|
||||
|
||||
Reference in New Issue
Block a user