# [PATCH 1/3] refs.c: ensure struct whose member may be passed to realloc is initialized 3 messages from 2011-10-08 to 2011-10-08. Participants: Brandon Casey. Thread: https://gitlist.dev/t/28629 ## Brandon Casey, 2011-10-08 03:20 Subject: [PATCH 1/3] refs.c: ensure struct whose member may be passed to realloc is initialized Message-ID: <5WORKOGzj9pUA6-WazYHWim-cjAN1gZZBHymptluatadyqEWEpUinYhFsc02ctuYig5h-KCIT7ge7OiIw7zj9AjhDiO51YTCsLXHwmXkf9dE8yVtvwLqmJRFg5DOJRvlrZ-UjhNb04k@cipher.nrlssc.navy.mil> URL: https://gitlist.dev/e/5WORKOGzj9pUA6-WazYHWim-cjAN1gZZBHymptluatadyqEWEpUinYhFsc02ctuYig5h-KCIT7ge7OiIw7zj9AjhDiO51YTCsLXHwmXkf9dE8yVtvwLqmJRFg5DOJRvlrZ-UjhNb04k%40cipher.nrlssc.navy.mil In-Reply-To: <3k7giKa3PkJZo51iAXivXCFEZpYY2WC3depjtuvksrCQPax7dSLVCXpMlqLxWtZfSp6P10yMhMg@cipher.nrlssc.navy.mil> ``` From: Brandon Casey The variable "refs" is allocated on the stack but is not initialized. It is passed to read_packed_refs(), and its struct members may eventually be passed to add_ref() and ALLOC_GROW(). Since the structure has not been initialized, its members may contain random non-zero values. So let's initialize it. The call sequence looks something like this: resolve_gitlink_packed_ref(...) { struct cached_refs refs; ... read_packed_refs(f, &refs); ... } read_packed_refs(FILE*, struct cached_refs *cached_refs) { ... add_ref(name, sha1, flag, &cached_refs->packed, &last); ... } add_ref(..., struct ref_array *refs, struct ref_entry **) { ... ALLOC_GROW(refs->refs, refs->nr + 1, refs->alloc); } Signed-off-by: Brandon Casey --- refs.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/refs.c b/refs.c index 5835b40..c31b461 100644 --- a/refs.c +++ b/refs.c @@ -360,6 +360,7 @@ static int resolve_gitlink_packed_ref(char *name, int pathlen, const char *refna f = fopen(name, "r"); if (!f) return -1; + memset(&refs, 0, sizeof(refs)); read_packed_refs(f, &refs); fclose(f); ref = search_ref_array(&refs.packed, refname); -- 1.7.7 ``` ## Brandon Casey, 2011-10-08 03:20 Subject: [PATCH 2/3] refs.c: abort ref search if ref array is empty Message-ID: <5WORKOGzj9pUA6-WazYHWimMbFMh2dFdPh-tzgQwRKUjBmg5avzikX-E8YCuF6-WDVQwYJe92QfzjJryO0gSItzZkhfefVSSSpOvoOUGB9HVM7KEfTIWsriW5ZyQAa1YxwTYeujykWQ@cipher.nrlssc.navy.mil> URL: https://gitlist.dev/e/5WORKOGzj9pUA6-WazYHWimMbFMh2dFdPh-tzgQwRKUjBmg5avzikX-E8YCuF6-WDVQwYJe92QfzjJryO0gSItzZkhfefVSSSpOvoOUGB9HVM7KEfTIWsriW5ZyQAa1YxwTYeujykWQ%40cipher.nrlssc.navy.mil In-Reply-To: <3k7giKa3PkJZo51iAXivXCFEZpYY2WC3depjtuvksrCQPax7dSLVCXpMlqLxWtZfSp6P10yMhMg@cipher.nrlssc.navy.mil> ``` From: Brandon Casey The bsearch() implementation on IRIX 6.5 segfaults if it is passed NULL for the base array argument even if number-of-elements is zero. So, let's work around it by detecting an empty array and aborting early. This is a useful optimization in its own right anyway, since we avoid a useless allocation and initialization of the ref_entry when the ref array is empty. Signed-off-by: Brandon Casey --- refs.c | 3 +++ 1 files changed, 3 insertions(+), 0 deletions(-) diff --git a/refs.c b/refs.c index c31b461..cbc4c5d 100644 --- a/refs.c +++ b/refs.c @@ -110,6 +110,9 @@ static struct ref_entry *search_ref_array(struct ref_array *array, const char *n if (name == NULL) return NULL; + if (!array->nr) + return NULL; + len = strlen(name) + 1; e = xmalloc(sizeof(struct ref_entry) + len); memcpy(e->name, name, len); -- 1.7.7 ``` ## Brandon Casey, 2011-10-08 03:20 Subject: [PATCH 3/3] refs.c: free duplicate entries in the ref array instead of leaking them Message-ID: <5WORKOGzj9pUA6-WazYHWrx23BzZNuzssM-BrpbAt7jziy1qExfJm7by5NnJUMOk6ewCveYCPmzYGScMzowqtqJ8RZ9pZP6PRSU69BNSzr2gzdZ7nKtDsZyIEWyAD9p9GiIdHbxCa0M@cipher.nrlssc.navy.mil> URL: https://gitlist.dev/e/5WORKOGzj9pUA6-WazYHWrx23BzZNuzssM-BrpbAt7jziy1qExfJm7by5NnJUMOk6ewCveYCPmzYGScMzowqtqJ8RZ9pZP6PRSU69BNSzr2gzdZ7nKtDsZyIEWyAD9p9GiIdHbxCa0M%40cipher.nrlssc.navy.mil In-Reply-To: <3k7giKa3PkJZo51iAXivXCFEZpYY2WC3depjtuvksrCQPax7dSLVCXpMlqLxWtZfSp6P10yMhMg@cipher.nrlssc.navy.mil> ``` From: Brandon Casey Signed-off-by: Brandon Casey --- refs.c | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diff --git a/refs.c b/refs.c index cbc4c5d..df39297 100644 --- a/refs.c +++ b/refs.c @@ -94,6 +94,7 @@ static void sort_ref_array(struct ref_array *array) die("Duplicated ref, and SHA1s don't match: %s", a->name); warning("Duplicated ref: %s", a->name); + free(b); continue; } i++; -- 1.7.7 ```