[PATCH] Fix buffer overflow in ce_flush().

Add a check before appending SHA1 signature to write_buffer,
flush it first if necessary.

Signed-off-by: Junio C Hamano <junkio@cox.net>

1 files changed, 7 insertions, 0 deletions

diff --git a/read-cache.c b/read-cache.c
index ced597318e..6eff4c8401 100644
--- a/read-cache.c
+++ b/read-cache.c
@@ -462,6 +462,13 @@ static int ce_flush(SHA_CTX *context, int fd)
 		SHA1_Update(context, write_buffer, left);
 	}
 
+	/* Flush first if not enough space for SHA1 signature */
+	if (left + 20 > WRITE_BUFFER_SIZE) {
+		if (write(fd, write_buffer, left) != left)
+			return -1;
+		left = 0;
+	}
+
 	/* Append the SHA1 signature at the end */
 	SHA1_Final(write_buffer + left, context);
 	left += 20;