Thread (3 messages) flat view 3 messages, 2 authors, 2026-01-04

Re: [PATCH] reftable/iter: fix undefined behavior in indexed_table_ref_iter_next

From: Junio C Hamano <hidden>
Date: 2026-01-04 02:49:35

Tsahi Elkayam [off-list ref] writes:
  The indexed_table_ref_iter_next() function accesses ref->value.val2
  without first checking the ref's value_type. This is undefined behavior
  when the ref is not of type REFTABLE_REF_VAL2.

  The correct pattern is already used in filtering_ref_iterator_next()
  which checks value_type before accessing the appropriate union member.
  Apply the same pattern here:

   - Check for REFTABLE_REF_VAL2 before accessing val2 members
   - Add missing check for REFTABLE_REF_VAL1 to handle single-value refs

  This was marked with a "/* BUG */" comment indicating the issue was
  known but not yet fixed.

  Signed-off-by: Tsahi Elkayam [off-list ref]
  ---
   reftable/iter.c | 13 ++++++++-----
   1 file changed, 8 insertions(+), 5 deletions(-)

  diff --git a/reftable/iter.c b/reftable/iter.c
  index 2ecc52b336..2eee65bb1e 100644
  --- a/reftable/iter.c
  +++ b/reftable/iter.c
What are these lines with two-whitespace indent about?  When sending
a patch purely for discussion (because the actual change may be iffy
or dangerous), we sometimes deliberately corrupt the patch not to
apply mechanically, but this patch does not seem to be such a
"request for discussion" patch.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help