[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

NULL-pointer access when merging with 1.5.1

From: Stefan Küng <tortoisesvn_at_gmail.com>
Date: Mon, 28 Jul 2008 16:33:31 +0200

Hi,

The following conditions will trigger a NULL-pointer access:
* svn library 1.5.1 (I guess 1.5.0 too)
* merge results in a conflict
* user provides his own 'resolved' file in the conflict resolver callback
* the users own 'resolved' file has a path *not* in the same folder than
the conflicted file is located (best use a completely different path)

Since TortoiseSVN always creates the 'resolved' file in the %TEMP%
folder, every attempt to resolve a merge conflict in the callback leads
to a segfault.

The reason for this:

subversion\libsvn_wc\log.c : svn_wc__loggy_copy()
calls the function loggy_path() with those paths. But in loggy_path(),
if the path to the resolved file is not a child of the folder where the
conflict happened, it returns a NULL pointer as the string.

It seems that loggy_path() is a dangerous function: it assumes that
paths are relative to each other. For the 'resolved' file path, this
already leads to a segfault. But I assume that this causes other
problems with TSVN which I haven't been able yet to determine the exact
reason. Remember: UI applications don't have the 'current working
directory' set to what the command line client has it set. In TSVN, I
had to set the CWD to the %TEMP% folder because some svn functions write
temp files to the CWD - and if I don't set the CWD it can be anything,
even the SYSTEM32 folder which is write protected.

Stefan

-- 
        ___
   oo  // \\      "De Chelonian Mobile"
  (_,\/ \_/ \     TortoiseSVN
    \ \_/_\_/>    The coolest Interface to (Sub)Version Control
    /_/   \_\     http://tortoisesvn.net

Received on 2008-07-28 16:34:01 CEST

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.