Skip to content

Commit 8e92e8f

Browse files
stefanbellergitster
authored andcommitted
parse_object_buffer: correct freeing the buffer
If we exit early in the function parse_object_buffer, we did not write to *eaten_p. Then the calling function parse_object, which looks like the following with respect to the eaten variable, cannot rely on a proper value set in eaten, hence the freeing of the buffer depends on random values in memory. struct object *parse_object(const unsigned char *sha1) { int eaten; ... obj = parse_object_buffer(sha1, type, size, buffer, &eaten); if (!eaten) free(buffer); } This change makes sure, the buffer freeing condition is deterministic. Signed-off-by: Stefan Beller <[email protected]> Signed-off-by: Junio C Hamano <[email protected]>
1 parent 1599999 commit 8e92e8f

File tree

1 file changed

+3
-4
lines changed

1 file changed

+3
-4
lines changed

object.c

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ struct object *lookup_unknown_object(const unsigned char *sha1)
135135
struct object *parse_object_buffer(const unsigned char *sha1, enum object_type type, unsigned long size, void *buffer, int *eaten_p)
136136
{
137137
struct object *obj;
138-
int eaten = 0;
138+
*eaten_p = 0;
139139

140140
obj = NULL;
141141
if (type == OBJ_BLOB) {
@@ -154,7 +154,7 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t
154154
if (!tree->object.parsed) {
155155
if (parse_tree_buffer(tree, buffer, size))
156156
return NULL;
157-
eaten = 1;
157+
*eaten_p = 1;
158158
}
159159
}
160160
} else if (type == OBJ_COMMIT) {
@@ -164,7 +164,7 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t
164164
return NULL;
165165
if (!commit->buffer) {
166166
commit->buffer = buffer;
167-
eaten = 1;
167+
*eaten_p = 1;
168168
}
169169
obj = &commit->object;
170170
}
@@ -181,7 +181,6 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t
181181
}
182182
if (obj && obj->type == OBJ_NONE)
183183
obj->type = type;
184-
*eaten_p = eaten;
185184
return obj;
186185
}
187186

0 commit comments

Comments
 (0)