git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] do_one_ref(): save and restore value of current_ref

From
Junio C Hamano <gitster@pobox.com>
Date
Jul 18, 2013, 04:03 UTC
Message-ID
<7voba04ir8.fsf@alter.siamese.dyndns.org>
In-Reply-To
<1373901857-28431-1-git-send-email-mhagger@alum.mit.edu>
Michael Haggerty <mhagger@alum.mit.edu> writes:
Show 35 quoted lines
> If do_one_ref() is called recursively, then the inner call should not
> permanently overwrite the value stored in current_ref by the outer
> call.  Aside from the tiny optimization loss, peel_ref() expects the
> value of current_ref not to change across a call to peel_entry().  But
> in the presence of replace references that assumption could be
> violated by a recursive call to do_one_ref:
>
> do_for_each_entry()
>   do_one_ref()
>     builtin/describe.c:get_name()
>       peel_ref()
>         peel_entry()
>           peel_object ()
>             deref_tag_noverify()
>               parse_object()
>                 lookup_replace_object()
>                   do_lookup_replace_object()
>                     prepare_replace_object()
>                       do_for_each_ref()
>                         do_for_each_entry()
>                           do_for_each_entry_in_dir()
>                             do_one_ref()
>
> The inner call to do_one_ref() was unconditionally setting current_ref
> to NULL when it was done, causing peel_ref() to perform an invalid
> memory access.
>
> So change do_one_ref() to save the old value of current_ref before
> overwriting it, and restore the old value afterward rather than
> setting it to NULL.
>
> Reported by: Mantas Mikulėnas <grawity@gmail.com>
>
> Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu>
> ---
Thanks.
s/Reported by:/Reported-by:/ and lose the extra blank line after it?
I wonder if we can have an easy reproduction recipe in our tests.
Previous: Michael HaggertyNext: Michael Haggerty
Message 5 of 8 in “Segfault in `git describe`”
  1. Mantas MikulėnasJul 13, 2013
  2. Michael HaggertyJul 15, 2013
  3. Mantas MikulėnasJul 15, 2013
  4. do_one_ref(): save and restore value of current_refMichael Haggerty, Jul 15, 2013
  5. Junio C HamanoJul 18, 2013
  6. Michael HaggertyJul 19, 2013
  7. Junio C HamanoJul 19, 2013
  8. Michael HaggertyJul 24, 2013

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.