# [PATCH] am: check return value of resolve_refdup before using hash 2 messages from 2017-05-06 to 2017-05-09. Participants: René Scharfe, Jeff King. Thread: https://gitlist.dev/t/45889 ## René Scharfe, 2017-05-06 17:13 Subject: [PATCH] am: check return value of resolve_refdup before using hash Message-ID: URL: https://gitlist.dev/e/f0ca65bf-aaf9-2cd6-1deb-c55c9e7a8fa3%40web.de ``` If resolve_refdup() fails it returns NULL and possibly leaves its hash output parameter untouched. Make sure to use it only if the function succeeded, in order to avoid accessing uninitialized memory. Signed-off-by: Rene Scharfe --- builtin/am.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/builtin/am.c b/builtin/am.c index a95dd8b4e6..2c52c820aa 100644 --- a/builtin/am.c +++ b/builtin/am.c @@ -2156,7 +2156,7 @@ static void am_abort(struct am_state *state) am_rerere_clear(); curr_branch = resolve_refdup("HEAD", 0, curr_head.hash, NULL); - has_curr_head = !is_null_oid(&curr_head); + has_curr_head = curr_branch && !is_null_oid(&curr_head); if (!has_curr_head) hashcpy(curr_head.hash, EMPTY_TREE_SHA1_BIN); -- 2.12.2 ``` ## Jeff King, 2017-05-09 03:58 Subject: Re: [PATCH] am: check return value of resolve_refdup before using hash Message-ID: <20170509035807.2q7bzhu7cs4fcqkb@sigill.intra.peff.net> URL: https://gitlist.dev/e/20170509035807.2q7bzhu7cs4fcqkb%40sigill.intra.peff.net In-Reply-To: ``` On Sat, May 06, 2017 at 07:13:56PM +0200, René Scharfe wrote: > If resolve_refdup() fails it returns NULL and possibly leaves its hash > output parameter untouched. Make sure to use it only if the function > succeeded, in order to avoid accessing uninitialized memory. > > Signed-off-by: Rene Scharfe > --- > builtin/am.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/builtin/am.c b/builtin/am.c > index a95dd8b4e6..2c52c820aa 100644 > --- a/builtin/am.c > +++ b/builtin/am.c > @@ -2156,7 +2156,7 @@ static void am_abort(struct am_state *state) > am_rerere_clear(); > > curr_branch = resolve_refdup("HEAD", 0, curr_head.hash, NULL); > - has_curr_head = !is_null_oid(&curr_head); > + has_curr_head = curr_branch && !is_null_oid(&curr_head); > if (!has_curr_head) > hashcpy(curr_head.hash, EMPTY_TREE_SHA1_BIN); This one looks good to me (and no interesting ripple effects from handling the error correctly :) ). -Peff ```