git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH] format-patch: unleak "-v <num>"

From
Junio C Hamano <gitster@pobox.com>
Date
Jan 15, 2023, 08:03 UTC
Message-ID
<xmqqv8l8gr6s.fsf@gitster.g>

The "subject_prefix" member of "struct revision" usually is always set to a borrowed string (either a string literal like "PATCH" that appear in the program text as a hardcoded default, or the value of "format.subjectprefix") and is never freed when the containing revision structure is released. The "-v <num>" codepath however violates this rule and stores a pointer to an allocated string to this member, relinquishing the responsibility to free it when it is done using the revision structure, leading to a small one-time leak.

Instead, keep track of the string it allocates to let the revision structure borrow, and clean it up when it is done.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 builtin/log.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/builtin/log.c b/builtin/log.c
index e1fe7bbe71..3dddaadc1e 100644
--- a/builtin/log.c
+++ b/builtin/log.c
@@ -1879,6 +1879,7 @@ int cmd_format_patch(int argc, const char **argv, const char *prefix)
 	struct strbuf rdiff1 = STRBUF_INIT;
 	struct strbuf rdiff2 = STRBUF_INIT;
 	struct strbuf rdiff_title = STRBUF_INIT;
+	struct strbuf sprefix = STRBUF_INIT;
 	int creation_factor = -1;
 
 	const struct option builtin_format_patch_options[] = {
@@ -2019,12 +2020,10 @@ int cmd_format_patch(int argc, const char **argv, const char *prefix)
 		cover_from_description_mode = parse_cover_from_description(cover_from_description_arg);
 
 	if (reroll_count) {
-		struct strbuf sprefix = STRBUF_INIT;
-
 		strbuf_addf(&sprefix, "%s v%s",
 			    rev.subject_prefix, reroll_count);
 		rev.reroll_count = reroll_count;
-		rev.subject_prefix = strbuf_detach(&sprefix, NULL);
+		rev.subject_prefix = sprefix.buf;
 	}
 
 	for (i = 0; i < extra_hdr.nr; i++) {
@@ -2388,6 +2387,7 @@ int cmd_format_patch(int argc, const char **argv, const char *prefix)
 	strbuf_release(&rdiff1);
 	strbuf_release(&rdiff2);
 	strbuf_release(&rdiff_title);
+	strbuf_release(&sprefix);
 	free(to_free);
 	if (rev.ref_message_ids)
 		string_list_clear(rev.ref_message_ids, 0);
-- 
2.39.0-198-ga38d39a4c5
Next: Jeff King
Message 1 of 4 in “format-patch: unleak "-v <num>"”
  1. format-patch: unleak "-v <num>"Junio C Hamano, Jan 15, 2023
  2. Jeff KingJan 16, 2023
  3. Junio C HamanoJan 16, 2023
  4. Jeff KingJan 16, 2023

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.