[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

svn_client_delete4 can segfault

From: Stefan Küng <tortoisesvn_at_gmail.com>
Date: Wed, 07 Dec 2011 20:13:34 +0100

Hi,

from a few crash reports sent in for TSVN I was finally able to pin down
the problem:

in libsvn_client\delete.c, line 240 there's a call
repos_relpath = svn_uri__is_child(repos_root, uri, pool);

but that can return NULL.
further below then that repos_relpath is passed to svn_ra_check_path
which then segfaults.

looking at the code it's possible for repos_relpath to stay NULL, for
example, if the repo root is passed to svn_client_delete4 - which is of
course something that can't be done, but segfaulting is bad, instead an
error should be returned.
And I have to assume that if the url was entered with the wrong case,
svn_uri__is_child() would also return NULL.

on trunk, svn_uri__is_child() has been replaced with
svn_uri_skip_ancestor() (r1198802), but it works the same as
svn_uri__is_child() from what I can see.

Stefan

-- 
        ___
   oo  // \\      "De Chelonian Mobile"
  (_,\/ \_/ \     TortoiseSVN
    \ \_/_\_/>    The coolest Interface to (Sub)Version Control
    /_/   \_\     http://tortoisesvn.net
Received on 2011-12-07 20:14:12 CET

This is an archived mail posted to the Subversion Dev mailing list.