Thread (1 message) 1 message, 1 author, 2016-06-15

Re: [PATCH v4] name-hash: don't reuse cache_entry in dir_entry

From: Junio C Hamano <hidden>
Date: 2016-06-15 23:07:01

David Turner [off-list ref] writes:
Stop reusing cache_entry in dir_entry; doing so causes a
use-after-free bug.

During merges, we free entries that we no longer need in the
destination index.  But those entries might have also been stored in
the dir_entry cache, and when a later call to add_to_index found them,
they would be used after being freed.

To prevent this, change dir_entry to store a copy of the name instead
of a pointer to a cache_entry.  This entails some refactoring of code
that expects the cache_entry.

Keith McGuigan [off-list ref] diagnosed this bug and wrote
the initial patch, but this version does not use any of Keith's code.

Helped-by: Keith McGuigan [off-list ref]
Helped-by: Junio C Hamano [off-list ref]
Signed-off-by: David Turner <redacted>
---
The patch looks good to me.  Will replace the ce-refcnt one with
this.

Thanks for following it through.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help