svnserve crash

["D.J. Heap" <dj...@dhiprovo.com>]

If a pre-commit hook fails, svnserve may crash.  It appears that the 
commit function in serve.c is depending on the author and date variables 
being setup during the svn_ra_svn_drive_editor call, but that is not 
happening if a pre-commit hook returns an error.  So, depending on the 
stack state bad pointers may be passed to svn_ra_svn_write_tuple. 
Simply initializing date and author to "" seems to work, but I'm not 
sure if that's the correct fix.

Can someone comment on what the appropriate behavior should be here? 
I've inlined the commit function in serve.c below for quick reference.


static svn_error_t *commit(svn_ra_svn_conn_t *conn, apr_pool_t *pool,
                            apr_array_header_t *params, void *baton)
{
   server_baton_t *b = baton;
   const char *log_msg, *date, *author;
   const svn_delta_editor_t *editor;
   void *edit_baton;
   svn_boolean_t aborted;
   commit_callback_baton_t ccb;
   svn_revnum_t new_rev;

   SVN_ERR(svn_ra_svn_parse_tuple(params, pool, "c", &log_msg));
   SVN_CMD_ERR(must_not_be_read_only(b));
   ccb.new_rev = &new_rev;
   ccb.date = &date;
   ccb.author = &author;
   SVN_CMD_ERR(svn_repos_get_commit_editor(&editor, &edit_baton, b->repos,
                                           b->repos_url, b->fs_path, 
b->user,
                                           log_msg, commit_done, &ccb, 
pool));
   SVN_ERR(svn_ra_svn_write_cmd_response(conn, pool, ""));
   SVN_ERR(svn_ra_svn_drive_editor(conn, pool, editor, edit_baton, 
&aborted));
   if (!aborted)
     SVN_ERR(svn_ra_svn_write_tuple(conn, pool, "r(?c)(?c)",
                                    new_rev, date, author));
   return SVN_NO_ERROR;
}


DJ



**********************************************************************
This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity to
whom they are addressed. If you have received this email
in error please notify the system manager.

This footnote also confirms that this email message has been
swept by MIMEsweeper for the presence of computer viruses.

www.mimesweeper.com
**********************************************************************


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org