Fossil SCM

Avoid segfault while serving [/help?cmd=/wdiff|/wdiff] page with empty "pid" parameter in the quaery string. Segfault occurs due to dereferencing of NULL pointer in pW2, which happens because both name_to_typed_rid("","w") and manifest_get(0,...) return 0.

george 2021-03-13 22:15 wiki-history
Commit 7b81aac17a10ff4c62757c637fc73ea91628c71e20ea7aa70861798b22b2896a
1 file changed +2 -2
+2 -2
--- src/wiki.c
+++ src/wiki.c
@@ -1692,14 +1692,14 @@
16921692
zId = db_text(0, "SELECT uuid FROM blob WHERE rid=%d", rid1);
16931693
pW1 = manifest_get(rid1, CFTYPE_WIKI, 0);
16941694
if( pW1==0 ) fossil_redirect_home();
16951695
blob_init(&w1, pW1->zWiki, -1);
16961696
zPid = P("pid");
1697
- if( zPid==0 && pW1->nParent ){
1697
+ if( ( zPid==0 || zPid[0] == 0 ) && pW1->nParent ){
16981698
zPid = pW1->azParent[0];
16991699
}
1700
- if( zPid ){
1700
+ if( zPid && zPid[0] != 0 ){
17011701
char *zDate;
17021702
rid2 = name_to_typed_rid(zPid, "w");
17031703
pW2 = manifest_get(rid2, CFTYPE_WIKI, 0);
17041704
blob_init(&w2, pW2->zWiki, -1);
17051705
@ <h2>Changes to \
17061706
--- src/wiki.c
+++ src/wiki.c
@@ -1692,14 +1692,14 @@
1692 zId = db_text(0, "SELECT uuid FROM blob WHERE rid=%d", rid1);
1693 pW1 = manifest_get(rid1, CFTYPE_WIKI, 0);
1694 if( pW1==0 ) fossil_redirect_home();
1695 blob_init(&w1, pW1->zWiki, -1);
1696 zPid = P("pid");
1697 if( zPid==0 && pW1->nParent ){
1698 zPid = pW1->azParent[0];
1699 }
1700 if( zPid ){
1701 char *zDate;
1702 rid2 = name_to_typed_rid(zPid, "w");
1703 pW2 = manifest_get(rid2, CFTYPE_WIKI, 0);
1704 blob_init(&w2, pW2->zWiki, -1);
1705 @ <h2>Changes to \
1706
--- src/wiki.c
+++ src/wiki.c
@@ -1692,14 +1692,14 @@
1692 zId = db_text(0, "SELECT uuid FROM blob WHERE rid=%d", rid1);
1693 pW1 = manifest_get(rid1, CFTYPE_WIKI, 0);
1694 if( pW1==0 ) fossil_redirect_home();
1695 blob_init(&w1, pW1->zWiki, -1);
1696 zPid = P("pid");
1697 if( ( zPid==0 || zPid[0] == 0 ) && pW1->nParent ){
1698 zPid = pW1->azParent[0];
1699 }
1700 if( zPid && zPid[0] != 0 ){
1701 char *zDate;
1702 rid2 = name_to_typed_rid(zPid, "w");
1703 pW2 = manifest_get(rid2, CFTYPE_WIKI, 0);
1704 blob_init(&w2, pW2->zWiki, -1);
1705 @ <h2>Changes to \
1706

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button