Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

Fix invalid memory access bug in pager line wrapping

A reference to the first allocated line was cached as the return value.
If calls to add_line would force a reallocation of the view line array
the cached line reference would become invalid and lead to a segfault.
  • Loading branch information...
commit cb5eb1d549e32d0d7b014c96c7d999fab19783ac 1 parent 9e09e02
Jonas Fonseca jonas authored

Showing 1 changed file with 4 additions and 4 deletions. Show diff stats Hide diff stats

  1. +4 4 tig.c
8 tig.c
@@ -3968,12 +3968,12 @@ add_pager_refs(struct view *view, const char *commit_id)
3968 3968 static struct line *
3969 3969 pager_wrap_line(struct view *view, const char *data, enum line_type type)
3970 3970 {
3971   - struct line *first_line = NULL;
  3971 + size_t first_line = 0;
3972 3972 size_t datalen = strlen(data);
3973 3973 size_t lineno = 0;
3974 3974
3975 3975 while (datalen > 0 || !first_line) {
3976   - bool wrapped = first_line != NULL;
  3976 + bool wrapped = !!first_line;
3977 3977 size_t linelen = string_expanded_length(data, datalen, opt_tab_size, view->width - !!wrapped);
3978 3978 struct line *line;
3979 3979 char *text;
@@ -3982,7 +3982,7 @@ pager_wrap_line(struct view *view, const char *data, enum line_type type)
3982 3982 if (!line)
3983 3983 break;
3984 3984 if (!first_line)
3985   - first_line = line;
  3985 + first_line = view->lines - 1;
3986 3986 if (!wrapped)
3987 3987 lineno = line->lineno;
3988 3988
@@ -3997,7 +3997,7 @@ pager_wrap_line(struct view *view, const char *data, enum line_type type)
3997 3997 data += linelen;
3998 3998 }
3999 3999
4000   - return first_line;
  4000 + return first_line ? &view->line[first_line] : NULL;
4001 4001 }
4002 4002
4003 4003 static bool

0 comments on commit cb5eb1d

Please sign in to comment.
Something went wrong with that request. Please try again.