[PATCHv2] blame: fix memory corruption scrambling revision name in error message

SZEDER Gábor· Jul 24, 2017, 21:15 UTC · lore

When attempting to blame a non-existing path, git should show an error message like this:

  $ git blame e83c51633 -- nonexisting-file
  fatal: no such path nonexisting-file in e83c51633

Since the recent commit 835c49f7d (blame: rework methods that determine 'final' commit, 2017-05-24) the revision name is either missing or some scrambled characters are shown instead. The reason is that the revision name must be duplicated, because it is invalidated when the pending objects array is cleared in the meantime, but this commit dropped the duplication.

Restore the duplication of the revision name in the affected functions (find_single_final() and find_single_initial()).

Signed-off-by: SZEDER Gábor <szeder.dev@gmail.com>
---

Use xstrdup_or_null() in the first hunk.

 blame.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/blame.c b/blame.c
index 91e26e93e..f575e9cbf 100644
--- a/blame.c
+++ b/blame.c
@@ -1663,7 +1663,7 @@ static struct commit *find_single_final(struct rev_info *revs,
 		name = revs->pending.objects[i].name;
 	}
 	if (name_p)
-		*name_p = name;
+		*name_p = xstrdup_or_null(name);
 	return found;
 }
 
@@ -1735,7 +1735,7 @@ static struct commit *find_single_initial(struct rev_info *revs,
 		die("No commit to dig up from?");
 
 	if (name_p)
-		*name_p = name;
+		*name_p = xstrdup(name);
 	return found;
 }
 
@@ -1843,6 +1843,8 @@ void setup_scoreboard(struct blame_scoreboard *sb, const char *path, struct blam
 
 	if (orig)
 		*orig = o;
+
+	free((char *)final_commit_name);
 }

-- 
2.14.0.rc0.88.ge338f4246

Junio C Hamano· Jul 24, 2017, 21:41 UTC · re: SZEDER Gábor · lore

Re: [PATCHv2] blame: fix memory corruption scrambling revision name in error message

SZEDER Gábor <szeder.dev@gmail.com> writes:

Show 18 quoted lines

> When attempting to blame a non-existing path, git should show an error
> message like this:
>
>   $ git blame e83c51633 -- nonexisting-file
>   fatal: no such path nonexisting-file in e83c51633
>
> Since the recent commit 835c49f7d (blame: rework methods that
> determine 'final' commit, 2017-05-24) the revision name is either
> missing or some scrambled characters are shown instead.  The reason is
> that the revision name must be duplicated, because it is invalidated
> when the pending objects array is cleared in the meantime, but this
> commit dropped the duplication.
>
> Restore the duplication of the revision name in the affected functions
> (find_single_final() and find_single_initial()).
>
> Signed-off-by: SZEDER Gábor <szeder.dev@gmail.com>
> ---

Thanks.

I vaguely recall we had the same breakage in the code that was already fixed long time ago; that's a strange coincidence if the js/blame-lib topic reintroduced the same bug ;-).

Will queue.

Show 35 quoted lines

>
> Use xstrdup_or_null() in the first hunk.
>
>  blame.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/blame.c b/blame.c
> index 91e26e93e..f575e9cbf 100644
> --- a/blame.c
> +++ b/blame.c
> @@ -1663,7 +1663,7 @@ static struct commit *find_single_final(struct rev_info *revs,
>  		name = revs->pending.objects[i].name;
>  	}
>  	if (name_p)
> -		*name_p = name;
> +		*name_p = xstrdup_or_null(name);
>  	return found;
>  }
>  
> @@ -1735,7 +1735,7 @@ static struct commit *find_single_initial(struct rev_info *revs,
>  		die("No commit to dig up from?");
>  
>  	if (name_p)
> -		*name_p = name;
> +		*name_p = xstrdup(name);
>  	return found;
>  }
>  
> @@ -1843,6 +1843,8 @@ void setup_scoreboard(struct blame_scoreboard *sb, const char *path, struct blam
>  
>  	if (orig)
>  		*orig = o;
> +
> +	free((char *)final_commit_name);
>  }