unpack-trees: detect mismatching number of cache-tree/index entries

Same as the preceding commit, we unconditionally dereference the index's
cache entries depending on the number of cache-tree entries, which can
lead to a segfault when the cache-tree is corrupted. Fix this bug.

This also makes t4058 pass with the leak sanitizer enabled.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/t/t4058-diff-duplicates.sh b/t/t4058-diff-duplicates.sh
index 3f602adb055b201c245412252a7f24f362b185fa..18e5ac88c31174969c1762c5e93c46b618f7d1db 100755 (executable)
--- a/t/t4058-diff-duplicates.sh
+++ b/t/t4058-diff-duplicates.sh
@@ -10,6 +10,8 @@
 #   that the diff output isn't wildly unreasonable.
 
 test_description='test tree diff when trees have duplicate entries'
+
+TEST_PASSES_SANITIZE_LEAK=true
 . ./test-lib.sh
 
 # make_tree_entry <mode> <mode> <sha1>
@@ -143,11 +145,12 @@ test_expect_success 'reset --hard does not segfault' '
        test_grep "error: corrupted cache-tree has entries not present in index" err
 '
 
-test_expect_failure 'git diff HEAD does not segfault' '
+test_expect_success 'git diff HEAD does not segfault' '
        git checkout base &&
        GIT_TEST_CHECK_CACHE_TREE=false &&
        git reset --hard &&
-       test_might_fail git diff HEAD
+       test_must_fail git diff HEAD 2>err &&
+       test_grep "error: corrupted cache-tree has entries not present in index" err
 '
 
 test_expect_failure 'can switch to another branch when status is empty' '

diff --git a/unpack-trees.c b/unpack-trees.c
index 21cc197d4714d3686797fb76f01914b8b53fd8c4..e10a9d12091ea286757881be19fea9dff21f0e32 100644 (file)
--- a/unpack-trees.c
+++ b/unpack-trees.c
@@ -808,6 +808,8 @@ static int traverse_by_cache_tree(int pos, int nr_entries, int nr_names,
 
        if (!o->merge)
                BUG("We need cache-tree to do this optimization");
+       if (nr_entries + pos > o->src_index->cache_nr)
+               return error(_("corrupted cache-tree has entries not present in index"));
 
        /*
         * Do what unpack_callback() and unpack_single_entry() normally