[PATCH 0/3] double-free with git fetch --prefetch

From: Jeff King <peff@peff.net>
Date: Nov 12, 2024, 08:32 UTC
Message-ID: <20241112083204.GA2636868@coredump.intra.peff.net>
In-Reply-To: <20241112064951.GA619985@coredump.intra.peff.net>

On Tue, Nov 12, 2024 at 01:49:51AM -0500, Jeff King wrote:

Show 7 quoted lines

> Bisecting on:
> 
>   make SANITIZE=address &&
>   bin-wrappers/git fetch --prefetch origin master
> 
> turns up my ea4780307c (fetch: free "raw" string when shrinking refspec,
> 2024-09-24). I'll see if I can figure out what's going on.

OK, it turns out to be a fairly simple bug. The hardest part was figuring out why it was not triggering all the time already in the test suite. ;)

Patch 1 is the minimal fix. It is sort-of a regression in v2.47, in that it became easier to trigger the bug; but it existed before then. Either way, it seems like material for the "maint" branch.

The other two patches are cleanups that I contemplated when doing ea4780307c. Now that this code has caused _two_ bugs which would have been impossible with the cleanups, I figured it was worth taking a stab at it.

Thanks for a clear report.

  [1/3]: fetch: adjust refspec->raw_nr when filtering prefetch refspecs
  [2/3]: refspec: drop separate raw_nr count
  [3/3]: refspec: store raw refspecs inside refspec_item

 builtin/fetch.c                   |  8 ++------
 builtin/remote.c                  | 16 ++++++++--------
 refspec.c                         | 26 ++++++++++----------------
 refspec.h                         |  6 ++----
 submodule.c                       |  8 ++++----
 t/t5582-fetch-negative-refspec.sh |  4 ++++
 6 files changed, 30 insertions(+), 38 deletions(-)

-Peff