[PATCH 03/14] fetch-pack: defensive programming

From

Johannes Schindelin via GitGitGadget <gitgitgadget@gmail.com>

Date

May 15, 2025, 12:45 UTC

Message-ID

<9cafbd36817aabbe18197938c409edaddf7dcab2.1747313140.git.gitgitgadget@gmail.com>

In-Reply-To

<pull.1890.git.1747313139.gitgitgadget@gmail.com>

From: Johannes Schindelin <johannes.schindelin@gmx.de>

CodeQL points out that `parse_object()` can return NULL values.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 fetch-pack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fetch-pack.c b/fetch-pack.c
index 1ed5e11dd568..4cbcb0c14c48 100644
--- a/fetch-pack.c
+++ b/fetch-pack.c
@@ -155,7 +155,7 @@ static struct commit *deref_without_lazy_fetch(const struct object_id *oid,
 			struct tag *tag = (struct tag *)
 				parse_object(the_repository, oid);
 
-			if (!tag->tagged)
+			if (!tag || !tag->tagged)
 				return NULL;
 			if (mark_tags_complete_and_check_obj_db)
 				tag->object.flags |= COMPLETE;

-- 
gitgitgadget