[PATCH 2/2] Backup the array passed to fetch_pack so we can free items
From: Shawn O. Pearce <hidden>
Date: 2016-06-15 22:43:34
Subsystem:
the rest · Maintainer:
Linus Torvalds
fetch_pack() can call remove_duplicates() on its input array and this will possibly overwrite an earlier entry with a later one if there are any duplicates in the input array. In such a case the caller here might then attempt to free an item multiple times as it goes through its cleanup. I also forgot to free the heads array we pass down into fetch_pack() when I introduced the allocation of it in this function during my builtin-fetch cleanup series. Better free it while we are here working on related memory management fixes. Signed-off-by: Shawn O. Pearce <redacted> --- transport.c | 7 +++++-- 1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/transport.c b/transport.c
index 0882edd..0338ed4 100644
--- a/transport.c
+++ b/transport.c@@ -311,6 +311,7 @@ static int fetch_refs_via_pack(struct transport *transport, { struct git_transport_data *data = transport->data; char **heads = xmalloc(nr_heads * sizeof(*heads)); + char **origh = xmalloc(nr_heads * sizeof(*origh)); struct ref *refs; char *dest = xstrdup(transport->url); struct fetch_pack_args args;
@@ -329,11 +330,13 @@ static int fetch_refs_via_pack(struct transport *transport, setup_fetch_pack(&args); for (i = 0; i < nr_heads; i++) - heads[i] = xstrdup(to_fetch[i]->name); + origh[i] = heads[i] = xstrdup(to_fetch[i]->name); refs = fetch_pack(dest, nr_heads, heads, &transport->pack_lockfile); for (i = 0; i < nr_heads; i++) - free(heads[i]); + free(origh[i]); + free(origh); + free(heads); free_refs(refs); free(dest); return 0;
--
1.5.3.1.921.g8c3b