subversion-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From kot...@apache.org
Subject svn commit: r1706324 - /subversion/trunk/subversion/libsvn_ra_serf/multistatus.c
Date Thu, 01 Oct 2015 21:56:26 GMT
Author: kotkov
Date: Thu Oct  1 21:56:26 2015
New Revision: 1706324

URL: http://svn.apache.org/viewvc?rev=1706324&view=rev
Log:
Fix a crash in libsvn_ra_serf's multistatus parser.

One way to reproduce it is by trying to do a -g reverse blame against a
Subversion 1.8 server:

  svn blame -g -r 1706092:1706091 https://svn.apache.org/repos/asf/subversion/trunk/README

When rolling responses through the transition table, the multistatus parser
gathers attributes — e.g., <D:href> or <D:status> values.  They could then
be accessed by the parser upon closing a tag.  There are situations, such as
in the example above, when we don't gather these attributes, because there
actually is nothing to gather:

  <?xml version="1.0" encoding="utf-8"?>
  <D:error xmlns:D="DAV:" xmlns:C="svn:">
    <C:error/>
  </D:error>

Collecting attributes is done in a lazy fashion, and the corresponding hash
table can be null if nothing was collected.  If we try to access it a close
callback, we crash.  Fix this by using null-aware svn_hash__get_cstring()
function where necessary.

Found by: TortoiseSVN crash dump

* subversion/libsvn_ra_serf/multistatus.c
  (multistatus_closed): Use svn_hash__get_cstring() to access the attribute
   table when it can be null, i.e., within the MS_RESPONSE, MS_PROPSTAT
   and D_ERROR state handling.

Modified:
    subversion/trunk/subversion/libsvn_ra_serf/multistatus.c

Modified: subversion/trunk/subversion/libsvn_ra_serf/multistatus.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_ra_serf/multistatus.c?rev=1706324&r1=1706323&r2=1706324&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_ra_serf/multistatus.c (original)
+++ subversion/trunk/subversion/libsvn_ra_serf/multistatus.c Thu Oct  1 21:56:26 2015
@@ -315,7 +315,7 @@ multistatus_closed(svn_ra_serf__xml_esta
           svn_ra_serf__xml_note(xes, MS_RESPONSE, "errcode", errcode);
         break;
       case MS_RESPONSE:
-        if ((status = svn_hash_gets(attrs, "status")) != NULL)
+        if ((status = svn_hash__get_cstring(attrs, "status", NULL)) != NULL)
           {
             error_item_t *item;
 
@@ -369,7 +369,7 @@ multistatus_closed(svn_ra_serf__xml_esta
         break;
 
       case MS_PROPSTAT:
-        if ((status = svn_hash_gets(attrs, "status")) != NULL)
+        if ((status = svn_hash__get_cstring(attrs, "status", NULL)) != NULL)
           {
             apr_hash_t *response_attrs;
             error_item_t *item;
@@ -428,7 +428,8 @@ multistatus_closed(svn_ra_serf__xml_esta
           item->http_status = server_error->handler->sline.code;
 
           /* Do we have a mod_dav specific message? */
-          item->message = svn_hash_gets(attrs, "human-readable");
+          item->message = svn_hash__get_cstring(attrs, "human-readable",
+                                                NULL);
 
           if (item->message)
             {



Mime
View raw message