Signed-off-by: Faiz Kothari <>

    I finally got what's happening, and why the errors were caused.
    packname is supposed to contain the complete path to the .pack file.
    Packs are stored as /path/to/<SHA1>.pack which I overlooked earlier.
    After inspecting what is happening in pack-write.c:finish_tmp_packfile()
    which indirectly modifies packname by appending the SHA1 and ".pack" to 
    This is happening in these code snippets:
        char *end_of_name_prefix = strrchr(name_buffer, 0);
    and later
        sprintf(end_of_name_prefix, "%s.pack", sha1_to_hex(sha1));
    name_buffer is packname.buf
    Using const for the first argument of pack-write.c:finish_tmp_packfile()
    doesnot raise any compile time warning or error and not any runtime errors,
    since the packname.buf is on heap and has extra space to which more char 
can be written.
    If this was not the case,
        for e.g. passing a constant string and modifying it.
        This will result in a segmentation fault.
 bulk-checkin.c |    8 +++++---
 pack-write.c   |    2 +-
 pack.h         |    2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/bulk-checkin.c b/bulk-checkin.c
index 118c625..bbdf1ec 100644
--- a/bulk-checkin.c
+++ b/bulk-checkin.c
@@ -23,7 +23,7 @@ static struct bulk_checkin_state {
 static void finish_bulk_checkin(struct bulk_checkin_state *state)
        unsigned char sha1[20];
-       char packname[PATH_MAX];
+       struct strbuf packname = STRBUF_INIT;
        int i;
        if (!state->f)
@@ -42,9 +42,10 @@ static void finish_bulk_checkin(struct bulk_checkin_state 
+       strbuf_addf(&packname, "%s/pack/pack-", get_object_directory());
+       strbuf_grow(&packname, 40 + 5);
-       sprintf(packname, "%s/pack/pack-", get_object_directory());
-       finish_tmp_packfile(packname, state->pack_tmp_name,
+       finish_tmp_packfile(packname.buf, state->pack_tmp_name,
                            state->written, state->nr_written,
                            &state->pack_idx_opts, sha1);
        for (i = 0; i < state->nr_written; i++)
@@ -53,6 +54,7 @@ static void finish_bulk_checkin(struct bulk_checkin_state 
        memset(state, 0, sizeof(*state));
+       strbuf_release(&packname);
        /* Make objects we just wrote available to ourselves */
diff --git a/pack-write.c b/pack-write.c
index 605d01b..ac38867 100644
--- a/pack-write.c
+++ b/pack-write.c
@@ -336,7 +336,7 @@ struct sha1file *create_tmp_packfile(char **pack_tmp_name)
        return sha1fd(fd, *pack_tmp_name);
-void finish_tmp_packfile(char *name_buffer,
+void finish_tmp_packfile(const char *name_buffer,
                         const char *pack_tmp_name,
                         struct pack_idx_entry **written_list,
                         uint32_t nr_written,
diff --git a/pack.h b/pack.h
index 12d9516..3b9e033 100644
--- a/pack.h
+++ b/pack.h
@@ -91,6 +91,6 @@ extern int encode_in_pack_object_header(enum object_type, 
uintmax_t, unsigned ch
 extern int read_pack_header(int fd, struct pack_header *);
 extern struct sha1file *create_tmp_packfile(char **pack_tmp_name);
-extern void finish_tmp_packfile(char *name_buffer, const char *pack_tmp_name, 
struct pack_idx_entry **written_list, uint32_t nr_written, struct 
pack_idx_option *pack_idx_opts, unsigned char sha1[]);
+extern void finish_tmp_packfile(const char *name_buffer, const char 
*pack_tmp_name, struct pack_idx_entry **written_list, uint32_t nr_written, 
struct pack_idx_option *pack_idx_opts, unsigned char sha1[]);

To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to
More majordomo info at

Reply via email to