svn commit: r1840991 - /subversion/trunk/subversion/libsvn_client/conflicts.c

[st...@apache.org]

Author: stsp
Date: Sun Sep 16 09:10:58 2018
New Revision: 1840991

URL: http://svn.apache.org/viewvc?rev=1840991&view=rev
Log:
Prevent an out-of-bounds array access in the conflict resolver.

* subversion/libsvn_client/conflicts.c
  (svn_client_conflict_option_set_moved_to_repos_relpath): Reset our index into
   the array of candidate working copy paths when a new repository-side move
   target path is selected. We could be switching from a repository-side move
   target with many corresponding working copy paths to one with fewer
   corresponding working copy paths. If the array index isn't reset then we
   crash if the user next tries to view an updated option description, because
   the description includes the currently selected working copy candidate path
   which is obtained by indexing the array.

Modified:
    subversion/trunk/subversion/libsvn_client/conflicts.c

Modified: subversion/trunk/subversion/libsvn_client/conflicts.c
URL: http://svn.apache.org/viewvc/subversion/trunk/subversion/libsvn_client/conflicts.c?rev=1840991&r1=1840990&r2=1840991&view=diff
==============================================================================
--- subversion/trunk/subversion/libsvn_client/conflicts.c (original)
+++ subversion/trunk/subversion/libsvn_client/conflicts.c Sun Sep 16 09:10:58 2018
@@ -10547,6 +10547,7 @@ svn_client_conflict_option_set_moved_to_
       if (strcmp(move_target_repos_relpath, repos_relpath) == 0)
         {
           details->move_target_repos_relpath = repos_relpath;
+          details->wc_move_target_idx = 0;
           /* Update option description. */
           SVN_ERR(describe_incoming_move_merge_conflict_option(
                     &option->description,