subversion-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From james...@apache.org
Subject svn commit: r1738259 - /subversion/trunk/subversion/libsvn_repos/log.c
Date Fri, 08 Apr 2016 15:28:27 GMT
Author: jamessan
Date: Fri Apr  8 15:28:27 2016
New Revision: 1738259

URL: http://svn.apache.org/viewvc?rev=1738259&view=rev
Log:
* subversion/libsvn_repos/log.c
  (do_logs): Use sizeof(*cur_rev) instead of sizeof(cur_rev) to fix out of
    bounds read when sizeof(svn_revnum_t) < sizeof(svn_revnum_t *)

Found by: Coverity <https://scan.coverity.com>
(CID: 1331600)

Modified:
    subversion/trunk/subversion/libsvn_repos/log.c

Modified: subversion/trunk/subversion/libsvn_repos/log.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_repos/log.c?rev=1738259&r1=1738258&r2=1738259&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_repos/log.c (original)
+++ subversion/trunk/subversion/libsvn_repos/log.c Fri Apr  8 15:28:27 2016
@@ -2079,7 +2079,7 @@ do_logs(svn_fs_t *fs,
               if (added_mergeinfo || deleted_mergeinfo)
                 {
                   svn_revnum_t *cur_rev =
-                    apr_pmemdup(pool, &current, sizeof(cur_rev));
+                    apr_pmemdup(pool, &current, sizeof(*cur_rev));
                   struct added_deleted_mergeinfo *add_and_del_mergeinfo =
                     apr_palloc(pool, sizeof(*add_and_del_mergeinfo));
 



Mime
View raw message