[PATCH 1/3] refs.c: ensure struct whose member may be passed to realloc is initialized
- From
Brandon Casey <casey@nrlssc.navy.mil>
- Date
- Oct 8, 2011, 03:20 UTC
- Message-ID
- <5WORKOGzj9pUA6-WazYHWim-cjAN1gZZBHymptluatadyqEWEpUinYhFsc02ctuYig5h-KCIT7ge7OiIw7zj9AjhDiO51YTCsLXHwmXkf9dE8yVtvwLqmJRFg5DOJRvlrZ-UjhNb04k@cipher.nrlssc.navy.mil>
- In-Reply-To
- <3k7giKa3PkJZo51iAXivXCFEZpYY2WC3depjtuvksrCQPax7dSLVCXpMlqLxWtZfSp6P10yMhMg@cipher.nrlssc.navy.mil>
From: Brandon Casey <drafnel@gmail.com>
The variable "refs" is allocated on the stack but is not initialized. It is passed to read_packed_refs(), and its struct members may eventually be passed to add_ref() and ALLOC_GROW(). Since the structure has not been initialized, its members may contain random non-zero values. So let's initialize it.
The call sequence looks something like this:
resolve_gitlink_packed_ref(...) { struct cached_refs refs;
...
read_packed_refs(f, &refs);
...
} read_packed_refs(FILE*, struct cached_refs *cached_refs) {
...
add_ref(name, sha1, flag, &cached_refs->packed, &last);
...
} add_ref(..., struct ref_array *refs, struct ref_entry **) {
...
ALLOC_GROW(refs->refs, refs->nr + 1, refs->alloc);
}Signed-off-by: Brandon Casey <casey@nrlssc.navy.mil> --- refs.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
diff --git a/refs.c b/refs.c index 5835b40..c31b461 100644 --- a/refs.c +++ b/refs.c @@ -360,6 +360,7 @@ static int resolve_gitlink_packed_ref(char *name, int pathlen, const char *refna f = fopen(name, "r"); if (!f) return -1; + memset(&refs, 0, sizeof(refs)); read_packed_refs(f, &refs); fclose(f); ref = search_ref_array(&refs.packed, refname);
-- 1.7.7