From 112973615a78ce61fd6e767128df03b075be72ca Mon Sep 17 00:00:00 2001
From: Eric Wong <normalperson@yhbt.net>
Date: Sat, 14 Mar 2009 18:41:47 -0700
Subject: fix segfault when displaying empty blobs

When size is zero, subtracting one from it turns it into
ULONG_MAX which causes an out-of-bounds access on buf.

Signed-off-by: Eric Wong <normalperson@yhbt.net>
Signed-off-by: Lars Hjemli <hjemli@gmail.com>

diff --git a/ui-tree.c b/ui-tree.c
index c6159ec..553dbaa 100644
--- a/ui-tree.c
+++ b/ui-tree.c
@@ -25,11 +25,14 @@ static void print_text_buffer(char *buf, unsigned long size)
 	html("<tr><td class='linenumbers'><pre>");
 	idx = 0;
 	lineno = 0;
-	htmlf(numberfmt, ++lineno);
-	while(idx < size - 1) { // skip absolute last newline
-		if (buf[idx] == '\n')
-			htmlf(numberfmt, ++lineno);
-		idx++;
+
+	if (size) {
+		htmlf(numberfmt, ++lineno);
+		while(idx < size - 1) { // skip absolute last newline
+			if (buf[idx] == '\n')
+				htmlf(numberfmt, ++lineno);
+			idx++;
+		}
 	}
 	html("</pre></td>\n");
 	html("<td class='lines'><pre><code>");
-- 
cgit v0.10.1


From 6fddad7251021b307c8a3f70fdd2aa04c3f74eaa Mon Sep 17 00:00:00 2001
From: Lars Hjemli <hjemli@gmail.com>
Date: Sun, 15 Mar 2009 08:57:33 +0100
Subject: ui-snapshot: avoid segfault when no filename is specified

Signed-off-by: Lars Hjemli <hjemli@gmail.com>

diff --git a/ui-snapshot.c b/ui-snapshot.c
index f25613e..5372f5d 100644
--- a/ui-snapshot.c
+++ b/ui-snapshot.c
@@ -156,20 +156,31 @@ static const char *get_ref_from_filename(const char *url, const char *filename,
 	return NULL;
 }
 
+void show_error(char *msg)
+{
+	ctx.page.mimetype = "text/html";
+	cgit_print_http_headers(&ctx);
+	cgit_print_docstart(&ctx);
+	cgit_print_pageheader(&ctx);
+	cgit_print_error(msg);
+	cgit_print_docend();
+}
+
 void cgit_print_snapshot(const char *head, const char *hex,
 			 const char *filename, int snapshots, int dwim)
 {
 	const struct cgit_snapshot_format* f;
 	char *prefix = NULL;
 
+	if (!filename) {
+		show_error("No snapshot name specified");
+		return;
+	}
+
 	f = get_format(filename);
 	if (!f) {
-		ctx.page.mimetype = "text/html";
-		cgit_print_http_headers(&ctx);
-		cgit_print_docstart(&ctx);
-		cgit_print_pageheader(&ctx);
-		cgit_print_error(fmt("Unsupported snapshot format: %s", filename));
-		cgit_print_docend();
+		show_error(xstrdup(fmt("Unsupported snapshot format: %s",
+				       filename)));
 		return;
 	}
 
-- 
cgit v0.10.1