[PATCH] checkout: check return value of resolve_refdup before using hash
- From
René Scharfe <l.s.r@web.de>
- Date
- May 6, 2017, 17:13 UTC
- Message-ID
- <f2e1a050-13e8-89be-ec6e-778054882ea3@web.de>
If resolve_refdup() fails it returns NULL and possibly leaves its hash output parameter untouched. Make sure to use it only if the function succeeded, in order to avoid accessing uninitialized memory.
Found with t/t2011-checkout-invalid-head.sh --valgrind.
Signed-off-by: Rene Scharfe <l.s.r@web.de> --- builtin/checkout.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/builtin/checkout.c b/builtin/checkout.c index bfa5419f33..6c3d2e4f4c 100644 --- a/builtin/checkout.c +++ b/builtin/checkout.c @@ -833,7 +833,8 @@ static int switch_branches(const struct checkout_opts *opts, int flag, writeout_error = 0; memset(&old, 0, sizeof(old)); old.path = path_to_free = resolve_refdup("HEAD", 0, rev.hash, &flag); - old.commit = lookup_commit_reference_gently(rev.hash, 1); + if (old.path) + old.commit = lookup_commit_reference_gently(rev.hash, 1); if (!(flag & REF_ISSYMREF)) old.path = NULL;
-- 2.12.2