From: Junio C Hamano <gitster@pobox.com>
Date: Wed, 21 Oct 2015 19:49:04 GMT
Subject: Re: [PATCH v4] name-hash: don't reuse cache_entry in dir_entry
Message-ID: <xmqqpp08uhn3.fsf@gitster.mtv.corp.google.com>
In-Reply-To: <1445450051-7430-1-git-send-email-dturner@twopensource.com>

David Turner <dturner@twopensource.com> writes:

> Stop reusing cache_entry in dir_entry; doing so causes a
> use-after-free bug.
>
> During merges, we free entries that we no longer need in the
> destination index.  But those entries might have also been stored in
> the dir_entry cache, and when a later call to add_to_index found them,
> they would be used after being freed.
>
> To prevent this, change dir_entry to store a copy of the name instead
> of a pointer to a cache_entry.  This entails some refactoring of code
> that expects the cache_entry.
>
> Keith McGuigan <kmcguigan@twitter.com> diagnosed this bug and wrote
> the initial patch, but this version does not use any of Keith's code.
>
> Helped-by: Keith McGuigan <kmcguigan@twitter.com>
> Helped-by: Junio C Hamano <gitster@pobox.com>
> Signed-off-by: David Turner <dturner@twopensource.com>
> ---

The patch looks good to me.  Will replace the ce-refcnt one with
this.

Thanks for following it through.