git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [BUG] git stash show -p with invalid option aborts with double-free in show_stash() (strvec_clear)

From
KHKristoffer Haugsbakk <kristofferhaugsbakk@fastmail.com>
Date
Sep 19, 2025, 13:11 UTC
Message-ID
<1321ff39-6f09-426a-aa75-939ef4e1ad93@app.fastmail.com>
In-Reply-To
<CAMCKZdV+ASXAhYXaTdtB=7YZprCxFUjwEsqQP7i_ccOwx8Lo6Q@mail.gmail.com>
On Fri, Sep 19, 2025, at 12:18, Lauri Niskanen wrote:
Show 23 quoted lines
> What did you do before the bug happened?
>
> Create a repo and a stash entry, then invoke `git stash show -p` with
> an invalid option:
>
> git init repro
> cd repro
> touch a
> git add a
> git commit -m init
> echo x >> a
> git stash
> git stash show -p --invalid
>
>
> What did you expect to happen?
>
> Git should print a usage / option error and exit cleanly without crashing.
>
>
> What happened instead?
>
> free(): double free detected in tcache 2

This bisects to 748bd094 (builtin/stash: fix leak in `show_stash()`, 2024-06-11) for me.

> GDB backtrace:
>[snip]
-- 
Kristoffer Haugsbakk
Previous: Lauri NiskanenNext: Junio C Hamano
Message 2 of 26 in “[BUG] git stash show -p with invalid option aborts with double-free in show_stash() (strvec_clear)”
  1. Lauri NiskanenSep 19, 2025
  2. Kristoffer HaugsbakkSep 19, 2025
  3. Junio C HamanoSep 19, 2025
  4. Jeff KingSep 19, 2025
  5. Junio C HamanoSep 19, 2025
  6. Junio C HamanoSep 19, 2025
  7. Jeff KingSep 19, 2025
  8. Junio C HamanoSep 19, 2025
  9. Jeff KingSep 19, 2025
  10. 0/6 fixing double-frees and leaks via setup_revisions()Jeff King, Sep 19, 2025
  11. 1/6 stash: tell setup_revisions() to free our allocated stringsJeff King, Sep 19, 2025
  12. Junio C HamanoSep 22, 2025
  13. Jeff KingSep 22, 2025
  14. Junio C HamanoSep 22, 2025
  15. Jeff KingSep 22, 2025
  16. Junio C HamanoSep 22, 2025
  17. Jeff KingSep 23, 2025
  18. 2/6 revision: manage memory ownership of argv in setup_revisions()Jeff King, Sep 19, 2025
  19. 3/6 revision: add wrapper to setup_revisions() from a strvecJeff King, Sep 19, 2025
  20. Eric SunshineSep 20, 2025
  21. Jeff KingSep 20, 2025
  22. 4/6 treewide: use setup_revisions_from_strvec() when we have a strvecJeff King, Sep 19, 2025
  23. 5/6 treewide: pass strvecs around for setup_revisions_from_strvec()Jeff King, Sep 19, 2025
  24. Jeff KingSep 19, 2025
  25. 6/6 revision: retain argv NULL invariant in setup_revisions()Jeff King, Sep 19, 2025
  26. Jeff KingSep 19, 2025

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.