[PATCH] parse_object_buffer: Correct freeing the buffer.
- From
Stefan Beller <stefanbeller@googlemail.com>
- Date
- Jul 17, 2013, 22:09 UTC
- Message-ID
- <1374098982-6962-1-git-send-email-stefanbeller@googlemail.com>
- In-Reply-To
- <51E715D8.9040307@googlemail.com>
If we exit early in the function parse_object_buffer, we did not write to *eaten_p. Then the calling function parse_object, which looks like the following with respect to the eaten variable, cannot rely on a proper value set in eaten, hence the freeing of the buffer depends on random values in memory.
struct object *parse_object(const unsigned char *sha1)
{
int eaten;
...
obj = parse_object_buffer(sha1, type, size, buffer, &eaten);
if (!eaten)
free(buffer);
}This change makes sure, the buffer freeing condition is deterministic.
Signed-off-by: Stefan Beller <stefanbeller@googlemail.com> --- object.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/object.c b/object.c index cbc7333..d8a4b1f 100644 --- a/object.c +++ b/object.c @@ -145,7 +145,7 @@ struct object *lookup_unknown_object(const unsigned char *sha1) struct object *parse_object_buffer(const unsigned char *sha1, enum object_type type, unsigned long size, void *buffer, int *eaten_p) { struct object *obj; - int eaten = 0; + *eaten_p = 0; obj = NULL; if (type == OBJ_BLOB) { @@ -164,7 +164,7 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t if (!tree->object.parsed) { if (parse_tree_buffer(tree, buffer, size)) return NULL; - eaten = 1; + *eaten_p = 1; } } } else if (type == OBJ_COMMIT) { @@ -174,7 +174,7 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t return NULL; if (!commit->buffer) { commit->buffer = buffer; - eaten = 1; + *eaten_p = 1; } obj = &commit->object; } @@ -191,7 +191,6 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t } if (obj && obj->type == OBJ_NONE) obj->type = type; - *eaten_p = eaten; return obj; }
-- 1.8.3.3.754.g9c3c367.dirty