Re: New NULL dereference in sequence.c
- From
René Scharfe <rene.scharfe@lsrfire.ath.cx>
- Date
- May 2, 2012, 12:53 UTC
- Message-ID
- <4FA12E42.201@lsrfire.ath.cx>
- In-Reply-To
- <CANV9Rr9PFR7SA_3jB-6PRF_V+4yB-FsYEuX5gs-LMpoTAxGDCQ@mail.gmail.com>
[cc:ing the author of this commit]
Am 02.05.2012 10:45, schrieb Michael Mueller:
Show 24 quoted lines
> Hi all,
>
> The last defect Sentry picked up has been removed, yay! At the same
> time, a new NULL dereference bug appeared, in sequencer.c:
>
> static int is_index_unchanged(void)
> {
> unsigned char head_sha1[20];
> struct commit *head_commit;
>
> if (!resolve_ref_unsafe("HEAD", head_sha1, 1, NULL))
> return error(_("Could not resolve HEAD commit\n"));
>
> head_commit = lookup_commit(head_sha1);
> if (!head_commit || parse_commit(head_commit))
> return error(_("could not parse commit %s\n"),
> sha1_to_hex(head_commit->object.sha1));
>
> In the last line quoted above, head_commit may be NULL, and it is
> dereferenced in the call to sha1_to_hex. Assuming lookup_commit(head_sha1)
> can return NULL, this function will segfault.
>
> Introduced here:
> https://github.com/gitster/git/commit/b27cfb0#sequencer.cSimilar code in builtin/commit.c just reports "could not parse HEAD commit" without any hash and thus no pointer dereference.
René