From seth at userprimary.net  Tue Mar 16 04:06:58 2010
From: seth at userprimary.net (Seth Falcon)
Date: Mon, 15 Mar 2010 20:06:58 -0700
Subject: [Rd] list_files() memory corruption?
In-Reply-To: <e63850351003121637rc13612et6fbd55fd453757f7@mail.gmail.com>
References: <e63850351003121637rc13612et6fbd55fd453757f7@mail.gmail.com>
Message-ID: <4B9EF5D2.8010107@userprimary.net>

Hi Alistair,

On 3/12/10 4:37 PM, Alistair Gee wrote:
> I am using R-2-10 from subversion.
> 
> In the implementation of do_listfiles() in platform.c, it appears to
> allocate a vector of length count where count is calculated by
> count_files(). It then proceeds to call list_files(), passing in the
> vector but not the value of count. Yet list_files() doesn't seem to
> check the length of the vector that was allocated.
> 
> What happens if a new file was added to the file system between the
> call to count_files() and list_files()? Doesn't this write past the
> length of the allocated vector?

Good catch.  I've added a length check to prevent a problem.

Cheers,

+ seth



[Rd] list_files() memory corruption?
Seth Falcon