about summary refs log tree commit diff
diff options
context:
space:
mode:
authorEric Wong <normalperson@yhbt.net>2009-03-14 18:41:47 -0700
committerLars Hjemli <hjemli@gmail.com>2009-03-15 08:46:15 +0100
commit112973615a78ce61fd6e767128df03b075be72ca (patch)
treecf4b3eb63f42d77ac77f74d951f583e1503886aa
parentui-tree: escape ascii-text properly in hexdump view (diff)
downloadcgit-pink-112973615a78ce61fd6e767128df03b075be72ca.tar.gz
cgit-pink-112973615a78ce61fd6e767128df03b075be72ca.zip
fix segfault when displaying empty blobs
When size is zero, subtracting one from it turns it into
ULONG_MAX which causes an out-of-bounds access on buf.

Signed-off-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>
-rw-r--r--ui-tree.c13
1 files changed, 8 insertions, 5 deletions
diff --git a/ui-tree.c b/ui-tree.c
index c6159ec..553dbaa 100644
--- a/ui-tree.c
+++ b/ui-tree.c
@@ -25,11 +25,14 @@ static void print_text_buffer(char *buf, unsigned long size)
 	html("<tr><td class='linenumbers'><pre>");
 	idx = 0;
 	lineno = 0;
-	htmlf(numberfmt, ++lineno);
-	while(idx < size - 1) { // skip absolute last newline
-		if (buf[idx] == '\n')
-			htmlf(numberfmt, ++lineno);
-		idx++;
+
+	if (size) {
+		htmlf(numberfmt, ++lineno);
+		while(idx < size - 1) { // skip absolute last newline
+			if (buf[idx] == '\n')
+				htmlf(numberfmt, ++lineno);
+			idx++;
+		}
 	}
 	html("</pre></td>\n");
 	html("<td class='lines'><pre><code>");