svn_client_delete4 can segfault

[Stefan Küng <to...@gmail.com>]

Hi,

from a few crash reports sent in for TSVN I was finally able to pin down 
the problem:

in libsvn_client\delete.c, line 240 there's a call
repos_relpath = svn_uri__is_child(repos_root, uri, pool);

but that can return NULL.
further below then that repos_relpath is passed to svn_ra_check_path 
which then segfaults.

looking at the code it's possible for repos_relpath to stay NULL, for 
example, if the repo root is passed to svn_client_delete4 - which is of 
course something that can't be done, but segfaulting is bad, instead an 
error should be returned.
And I have to assume that if the url was entered with the wrong case, 
svn_uri__is_child() would also return NULL.

on trunk, svn_uri__is_child() has been replaced with 
svn_uri_skip_ancestor() (r1198802), but it works the same as 
svn_uri__is_child() from what I can see.


Stefan

-- 
        ___
   oo  // \\      "De Chelonian Mobile"
  (_,\/ \_/ \     TortoiseSVN
    \ \_/_\_/>    The coolest Interface to (Sub)Version Control
    /_/   \_\     http://tortoisesvn.net

Re: svn_client_delete4 can segfault

[Philip Martin <ph...@wandisco.com>]

Stefan Küng <to...@gmail.com> writes:

> from a few crash reports sent in for TSVN I was finally able to pin
> down the problem:
>
> in libsvn_client\delete.c, line 240 there's a call
> repos_relpath = svn_uri__is_child(repos_root, uri, pool);
>
> but that can return NULL.
> further below then that repos_relpath is passed to svn_ra_check_path
> which then segfaults.

Easy to reproduce, I've raised issue 4074:
http://subversion.tigris.org/issues/show_bug.cgi?id=4074

-- 
uberSVN: Apache Subversion Made Easy
http://www.uberSVN.com

Re: svn_client_delete4 can segfault

[Julian Foad <ju...@btopenworld.com>]

Stefan Küng wrote:
> on trunk, svn_uri__is_child() has been replaced with svn_uri_skip_ancestor() 
> (r1198802), but it works the same as svn_uri__is_child() from what I can see.

Just answering this bit: no, _skip_ancestor() intentionally returns "" if the child is equal to the parent, whereas _is_child() returns null in that case.

- Julian