commit bdfcb0869a9b731044cf3b1acc797a805dd8eed9 from: Stefan Sperling date: Sat Oct 17 22:37:03 2020 UTC fix off-by-one access beyond mapped file in diff_data_atomize_text_lines_mmap() Thread 1 received signal SIGSEGV, Segmentation fault. 0x0000013992a89eca in diff_data_atomize_text_lines_mmap (d=0x13b9b455668) \ at /home/stsp/src/got/got/../lib/diff_atomize_text.c:134 134 if (line_end[0] == '\r' (gdb) p pos $1 = (const uint8_t *) 0x13be402006d "" (gdb) p end $2 = (const uint8_t *) 0x13be4023000 (gdb) p end-1 $3 = (const uint8_t *) 0x13be4022fff "" (gdb) p line_end $4 = (const uint8_t *) 0x13be4023000 commit - e6435d8f03f5310b07425d7d0acee7f0b8f52d8c commit + bdfcb0869a9b731044cf3b1acc797a805dd8eed9 blob - ed69c313f4ddb604d3cc46607cc371e59bdbc9ed blob + ba3fc3a79d5bde17c260332055d36a284a34cb76 --- lib/diff_atomize_text.c +++ lib/diff_atomize_text.c @@ -131,8 +131,8 @@ diff_data_atomize_text_lines_mmap(struct diff_data *d) if (line_end < end) line_end++; /* If that was an '\r', also pull in any following '\n' */ - if (line_end[0] == '\r' - && line_end < end && line_end[1] == '\n') + if (line_end < end && line_end[0] == '\r' && + line_end[1] == '\n') line_end++; /* Record the found line as diff atom */