git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 1/3] refs.c: ensure struct whose member may be passed to realloc is initialized

From
Brandon Casey <casey@nrlssc.navy.mil>
Date
Oct 8, 2011, 03:20 UTC
Message-ID
<5WORKOGzj9pUA6-WazYHWim-cjAN1gZZBHymptluatadyqEWEpUinYhFsc02ctuYig5h-KCIT7ge7OiIw7zj9AjhDiO51YTCsLXHwmXkf9dE8yVtvwLqmJRFg5DOJRvlrZ-UjhNb04k@cipher.nrlssc.navy.mil>
In-Reply-To
<3k7giKa3PkJZo51iAXivXCFEZpYY2WC3depjtuvksrCQPax7dSLVCXpMlqLxWtZfSp6P10yMhMg@cipher.nrlssc.navy.mil>
From: Brandon Casey <drafnel@gmail.com>

The variable "refs" is allocated on the stack but is not initialized. It is passed to read_packed_refs(), and its struct members may eventually be passed to add_ref() and ALLOC_GROW(). Since the structure has not been initialized, its members may contain random non-zero values. So let's initialize it.

The call sequence looks something like this:
   resolve_gitlink_packed_ref(...) {
       struct cached_refs refs;
       ...
       read_packed_refs(f, &refs);
       ...
   }
   read_packed_refs(FILE*, struct cached_refs *cached_refs) {
       ...
       add_ref(name, sha1, flag, &cached_refs->packed, &last);
       ...
   }
   add_ref(..., struct ref_array *refs, struct ref_entry **) {
       ...
       ALLOC_GROW(refs->refs, refs->nr + 1, refs->alloc);
   }
Signed-off-by: Brandon Casey <casey@nrlssc.navy.mil>
---
 refs.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/refs.c b/refs.c
index 5835b40..c31b461 100644
--- a/refs.c
+++ b/refs.c
@@ -360,6 +360,7 @@ static int resolve_gitlink_packed_ref(char *name, int pathlen, const char *refna
 	f = fopen(name, "r");
 	if (!f)
 		return -1;
+	memset(&refs, 0, sizeof(refs));
 	read_packed_refs(f, &refs);
 	fclose(f);
 	ref = search_ref_array(&refs.packed, refname);
-- 
1.7.7
Next: Brandon Casey
Message 1 of 3 in “refs.c: ensure struct whose member may be passed to realloc is initialized”
  1. 1/3 refs.c: ensure struct whose member may be passed to realloc is initializedBrandon Casey, Oct 8, 2011
  2. 2/3 refs.c: abort ref search if ref array is emptyBrandon Casey, Oct 8, 2011
  3. 3/3 refs.c: free duplicate entries in the ref array instead of leaking themBrandon Casey, Oct 8, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.