git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH v5] branch: support for shortcuts like @{-1}, completed

From
Junio C Hamano <gitster@pobox.com>
Date
Oct 9, 2022, 19:11 UTC
Message-ID
<xmqqa6647qx2.fsf@gitster.g>
In-Reply-To
<de200fa0-379d-c1ce-8446-9e4292d0b66a@gmail.com>
Rubén Justo <rjusto@gmail.com> writes:
Show 18 quoted lines
> @@ -791,19 +791,23 @@ int cmd_branch(int argc, const char **argv, const char *prefix)
>  	} else if (edit_description) {
>  		const char *branch_name;
>  		struct strbuf branch_ref = STRBUF_INIT;
> +		struct strbuf buf = STRBUF_INIT;
>  
>  		if (!argc) {
>  			if (filter.detached)
>  				die(_("Cannot give description to detached HEAD"));
>  			branch_name = head;
> -		} else if (argc == 1)
> -			branch_name = argv[0];
> +		} else if (argc == 1) {
> +			strbuf_branchname(&buf, argv[0], INTERPRET_BRANCH_LOCAL);
> +			branch_name = buf.buf;
> +		}
>  		else
>  			die(_("cannot edit description of more than one branch"));
Here branch_name could be pointing at buf.buf (or head).
>  		strbuf_addf(&branch_ref, "refs/heads/%s", branch_name);
>  		if (!ref_exists(branch_ref.buf)) {
>  			strbuf_release(&branch_ref);
> +			strbuf_release(&buf);
But the contents of the buf becomes invalid at this point.
>  			if (!argc)
>  				return error(_("No commit on branch '%s' yet."),

In the post context of this hunk, we see that the '%s' above is filled with branch_name, accessing the potentially invalid contents.

I'll put a squashable band-aid on top of the topic for now.
--- >8 ---
 * cmd_foo() should not return an negative value.
 * branch_name used in the calls to error() could point at buf.buf
   that holds the expansion of @{-1}, but buf was released way too
   early, leading to a use-after-free.
 * Style: if/else if/else cascade whose one arm has multiple
   statements and requires {braces} around it should have {braces}
   around all of its arms.
 * each arm in the top-level if/else if/else cascade for "git
   branch" subcommands were more or less independent, and there
   wasn't anything common that they need to execute after exiting
   the cascade.  Unconditionally returning from the arm for the
   edit-description subcommand seems to make the logic flow easier
   to read.
 builtin/branch.c | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)
diff --git a/builtin/branch.c b/builtin/branch.c
index 197603241d..17853225fa 100644
--- a/builtin/branch.c
+++ b/builtin/branch.c
@@ -792,6 +792,7 @@ int cmd_branch(int argc, const char **argv, const char *prefix)
 		const char *branch_name;
 		struct strbuf branch_ref = STRBUF_INIT;
 		struct strbuf buf = STRBUF_INIT;
+		int ret = 1; /* assume failure */
 
 		if (!argc) {
 			if (filter.detached)
@@ -800,29 +801,23 @@ int cmd_branch(int argc, const char **argv, const char *prefix)
 		} else if (argc == 1) {
 			strbuf_branchname(&buf, argv[0], INTERPRET_BRANCH_LOCAL);
 			branch_name = buf.buf;
-		}
-		else
+		} else {
 			die(_("cannot edit description of more than one branch"));
+		}
 
 		strbuf_addf(&branch_ref, "refs/heads/%s", branch_name);
-		if (!ref_exists(branch_ref.buf)) {
-			strbuf_release(&branch_ref);
-			strbuf_release(&buf);
-
-			if (!argc)
-				return error(_("No commit on branch '%s' yet."),
-					     branch_name);
-			else
-				return error(_("No branch named '%s'."),
-					     branch_name);
-		}
-		strbuf_release(&branch_ref);
+		if (!ref_exists(branch_ref.buf))
+			error(!argc
+			      ? _("No commit on branch '%s' yet.")
+			      : _("No branch named '%s'."),
+			      branch_name);
+		else if (!edit_branch_description(branch_name))
+			ret = 0; /* happy */
 
-		if (edit_branch_description(branch_name)) {
-			strbuf_release(&buf);
-			return 1;
-		}
+		strbuf_release(&branch_ref);
 		strbuf_release(&buf);
+
+		return ret;
 	} else if (copy) {
 		if (!argc)
 			die(_("branch name required"));
-- 
2.38.0-167-g3030fd6006
Previous: Junio C HamanoNext: Rubén Justo
Message 32 of 38 in “branch: support for at-refs like @{-1} in --edit-description, --set-upstream-to and --unset-upstream”
  1. 0/2 branch: support for at-refs like @{-1} in --edit-description, --set-upstream-to and --unset-upstreamRubén Justo via GitGitGadget, Sep 5, 2022
  2. 2/2 branch: support for at-refs like @{-1}Rubén Justo via GitGitGadget, Sep 5, 2022
  3. 1/2 branch: refactor edit_description command switch caseRubén Justo via GitGitGadget, Sep 5, 2022
  4. 0/2 branch: support for shortcuts like @{-1}, completedRubén Justo, Sep 7, 2022
  5. 1/2 branch: refactor "edit_description" code pathRubén Justo, Sep 7, 2022
  6. Junio C HamanoSep 7, 2022
  7. Rubén JustoSep 7, 2022
  8. Rubén JustoSep 8, 2022
  9. 2/2 branch: support for shortcuts like @{-1} completedRubén Justo, Sep 7, 2022
  10. 0/2 branch: support for shortcuts like @{-1}, completedRubén Justo, Sep 8, 2022
  11. 1/2 branch: refactor "edit_description" code pathRubén Justo, Sep 8, 2022
  12. branch: error codes for "edit_description"Rubén Justo, Sep 8, 2022
  13. Junio C HamanoSep 8, 2022
  14. 2/2 branch: support for shortcuts like @{-1} completedRubén Justo, Sep 8, 2022
  15. branch: support for shortcuts like @{-1}, completedRubén Justo, Oct 8, 2022
  16. Eric SunshineOct 8, 2022
  17. Junio C HamanoOct 8, 2022
  18. Rubén JustoOct 8, 2022
  19. Eric SunshineOct 8, 2022
  20. Rubén JustoOct 8, 2022
  21. Eric SunshineOct 8, 2022
  22. Junio C HamanoOct 8, 2022
  23. Rubén JustoOct 8, 2022
  24. Rubén JustoOct 8, 2022
  25. Eric SunshineOct 9, 2022
  26. Junio C HamanoOct 9, 2022
  27. Rubén JustoOct 9, 2022
  28. Junio C HamanoOct 8, 2022
  29. Rubén JustoOct 8, 2022
  30. branch: support for shortcuts like @{-1}, completedRubén Justo, Oct 8, 2022
  31. Junio C HamanoOct 9, 2022
  32. Junio C HamanoOct 9, 2022
  33. Rubén JustoOct 9, 2022
  34. Junio C HamanoOct 10, 2022
  35. Rubén JustoOct 10, 2022
  36. Junio C HamanoOct 10, 2022
  37. Rubén JustoOct 10, 2022
  38. branch: support for shortcuts like @{-1}, completedRubén Justo, Oct 10, 2022

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.