On Tue, Jan 28, 2020 at 06:26:40PM +0000, Derrick Stolee via GitGitGadget wrote: > From: Derrick Stolee <dstolee@xxxxxxxxxxxxx> > > In cone mode, the sparse-checkout feature uses hashset containment > queries to match paths. Make this algorithm respect escaped asterisk > (*) and backslash (\) characters. Do we also need to worry about other glob metacharacters? E.g., "?" or ranges like "[A-Z]"? > +static char *dup_and_filter_pattern(const char *pattern) > +{ > + char *set, *read; > + char *result = xstrdup(pattern); > + > + set = result; > + read = result; > + > + while (*read) { > + /* skip escape characters (once) */ > + if (*read == '\\') > + read++; > + > + *set = *read; > + > + set++; > + read++; > + } > + *set = 0; > + > + if (*(read - 2) == '/' && *(read - 1) == '*') > + *(read - 2) = 0; > + > + return result; > +} Do we need to check that the pattern is longer than 1 character here? If it's a single character, it seems like this "*(read - 2)" will dereference the byte before the string. -Peff