[PATCH 07/14] stash: defensive programming

From

Johannes Schindelin via GitGitGadget <gitgitgadget@gmail.com>

Date

May 15, 2025, 12:45 UTC

Message-ID

<81e873ea2ce5180006be9ad0121d2d5aafb44730.1747313140.git.gitgitgadget@gmail.com>

In-Reply-To

<pull.1890.git.1747313139.gitgitgadget@gmail.com>

From: Johannes Schindelin <johannes.schindelin@gmx.de>

CodeQL points out that `lookup_commit()` can return NULL values.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 builtin/stash.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/builtin/stash.c b/builtin/stash.c
index 23c4bbd3e21e..8efcd31d6c61 100644
--- a/builtin/stash.c
+++ b/builtin/stash.c
@@ -1396,6 +1396,11 @@ static int do_create_stash(const struct pathspec *ps, struct strbuf *stash_msg_b
 		goto done;
 	} else {
 		head_commit = lookup_commit(the_repository, &info->b_commit);
+		if (!head_commit) {
+			ret = error(_("could not look up commit '%s'"),
+				    oid_to_hex (&info->b_commit));
+			goto done;
+		}
 	}
 
 	if (!check_changes(ps, include_untracked, &untracked_files)) {

-- 
gitgitgadget