Shawn O. Pearcefetch_pack() can call remove_duplicates() on its input array and this will possibly overwrite an earlier entry with a later one if there are any duplicates in the input array. In such a case the caller here might then attempt to free an item multiple times as it goes through its cleanup.
I also forgot to free the heads array we pass down into fetch_pack() when I introduced the allocation of it in this function during my builtin-fetch cleanup series. Better free it while we are here working on related memory management fixes.
Signed-off-by: Shawn O. Pearce <spearce@spearce.org> --- transport.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-)
Show changes to transport.c +5 −2
diff --git a/transport.c b/transport.c index 0882edd..0338ed4 100644 --- a/transport.c +++ b/transport.c @@ -311,6 +311,7 @@ static int fetch_refs_via_pack(struct transport *transport, { struct git_transport_data *data = transport->data; char **heads = xmalloc(nr_heads * sizeof(*heads)); + char **origh = xmalloc(nr_heads * sizeof(*origh)); struct ref *refs; char *dest = xstrdup(transport->url); struct fetch_pack_args args; @@ -329,11 +330,13 @@ static int fetch_refs_via_pack(struct transport *transport, setup_fetch_pack(&args); for (i = 0; i < nr_heads; i++) - heads[i] = xstrdup(to_fetch[i]->name); + origh[i] = heads[i] = xstrdup(to_fetch[i]->name); refs = fetch_pack(dest, nr_heads, heads, &transport->pack_lockfile); for (i = 0; i < nr_heads; i++) - free(heads[i]); + free(origh[i]); + free(origh); + free(heads); free_refs(refs); free(dest); return 0;
-- 1.5.3.1.921.g8c3b