From: Jeff King <peff@peff.net>
Date: Fri, 19 Sep 2025 19:56:26 GMT
Subject: Re: [BUG] git stash show -p with invalid option aborts with double-free in show_stash() (strvec_clear)
Message-ID: <20250919195626.GA2750626@coredump.intra.peff.net>
In-Reply-To: <xmqqbjn65mxa.fsf@gitster.g>

On Fri, Sep 19, 2025 at 11:15:13AM -0700, Junio C Hamano wrote:

> Jeff King <peff@peff.net> writes:
> 
> > But really, I do not know that we need to NULL the whole thing. We have
> > given the caller the reduced argc. The only argv invariant we are
> > violating is that argv[argc] should be NULL (or in this case,
> > argv[left]). Anything after argv+left should be considered
> > uninitialized. So just:
> >
> >   argv[left] = NULL;
> >
> > would be enough, I'd think.
> 
> Even when strvec was passed and more than one element was eaten
> after parsing?  strvec_clear() goes by .nr not stopping at the first
> NULL IIRC.

Yes, there is a big can of worms here. ;) It turns out that many spots
with strvecs were relying on leaving these entries untouched, and so
setting any of them to NULL causes leaks.

I think I've got it mostly worked out, but that's why I haven't sent
patches yet. Stay tuned.

-Peff