When using "git format-patch", "get_patch_filename" in
"log-tree.c" calls "strbuf_splice" that could die with
the following message:

"`pos + len' is too far after the end of the buffer"

if you have:

	buf->len < start_len + FORMAT_PATCH_NAME_MAX

but:

	buf->len + suffix_len > start_len + FORMAT_PATCH_NAME_MAX

This patch tries to get rid of that bug.

Signed-off-by: Christian Couder <chriscool@tuxfamily.org>
---
 log-tree.c |   11 ++++++-----
 1 files changed, 6 insertions(+), 5 deletions(-)

This bug happens on "pu".

diff --git a/log-tree.c b/log-tree.c
index 56a3488..ade79ab 100644
--- a/log-tree.c
+++ b/log-tree.c
@@ -187,16 +187,17 @@ void get_patch_filename(struct commit *commit, int nr, const char *suffix,
 
 	strbuf_addf(buf, commit ? "%04d-" : "%d", nr);
 	if (commit) {
+		int max_len = start_len + FORMAT_PATCH_NAME_MAX;
 		format_commit_message(commit, "%f", buf, DATE_NORMAL);
 		/*
 		 * Replace characters at the end with the suffix if the
 		 * filename is too long
 		 */
-		if (buf->len + suffix_len > FORMAT_PATCH_NAME_MAX + start_len)
-			strbuf_splice(buf,
-				start_len + FORMAT_PATCH_NAME_MAX - suffix_len,
-				suffix_len, suffix, suffix_len);
-		else
+		if (buf->len + suffix_len > max_len) {
+			int base = (max_len > buf->len) ? buf->len : max_len;
+			strbuf_splice(buf, base - suffix_len, suffix_len,
+				      suffix, suffix_len);
+		} else
 			strbuf_addstr(buf, suffix);
 	}
 }
-- 
1.6.2.1.506.g7aa09

--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html