From b5c367f75c2990650119749a1add5216871ca47a Mon Sep 17 00:00:00 2001
From: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Date: Wed, 26 Oct 2005 16:18:56 +0200
Subject: [PATCH] Fix cloning (memory corruption)

upload-pack would set create_full_pack=1 if nr_has==0, but would ask later
if nr_needs<MAX_NEEDS. If that proves true, it would ignore create_full_pack,
and arguments would be written into unreserved memory.

Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
---
 upload-pack.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/upload-pack.c b/upload-pack.c
index 07c15059..878254d7 100644
--- a/upload-pack.c
+++ b/upload-pack.c
@@ -60,7 +60,7 @@ static void create_pack_file(void)
 		close(fd[1]);
 		*p++ = "git-rev-list";
 		*p++ = "--objects";
-		if (MAX_NEEDS <= nr_needs)
+		if (create_full_pack || MAX_NEEDS <= nr_needs)
 			*p++ = "--all";
 		else {
 			for (i = 0; i < nr_needs; i++) {
@@ -69,12 +69,13 @@ static void create_pack_file(void)
 				buf += 41;
 			}
 		}
-		for (i = 0; i < nr_has; i++) {
-			*p++ = buf;
-			*buf++ = '^';
-			memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
-			buf += 41;
-		}
+		if (!create_full_pack)
+			for (i = 0; i < nr_has; i++) {
+				*p++ = buf;
+				*buf++ = '^';
+				memcpy(buf, sha1_to_hex(has_sha1[i]), 41);
+				buf += 41;
+			}
 		*p++ = NULL;
 		execvp("git-rev-list", argv);
 		die("git-upload-pack: unable to exec git-rev-list");
-- 
2.11.0