Skip to content
Commits on Apr 20, 2010
  1. @jrn @gitster

    fix "bundle --stdin" segfault

    jrn committed with gitster
    When passed an empty list, objects_array_remove_duplicates() corrupts it
    by changing the number of entries from 0 to 1.
    The problem lies in the condition of its main loop:
    	for (ref = 0; ref < array->nr - 1; ref++) {
    The loop body manipulates the supplied object array.  In the case of an
    empty array, it should not be doing anything at all.  But array->nr is an
    unsigned quantity, so the code enters the loop, in particular increasing
    array->nr.  Fix this by comparing (ref + 1 < array->nr) instead.
    This bug can be triggered by git bundle --stdin:
    	$ echo HEAD | git bundle create some.bundle --stdin’
    	Segmentation fault (core dumped)
    The list of commits to bundle appears to be empty because of another bug:
    by the time the revision-walking machinery gets to look at it, standard
    input has already been consumed by rev-list, so this function gets an
    empty list of revisions.
    After this patch, git bundle --stdin still does not work; it just doesn’t
    segfault any more.
    Reported-by: Joey Hess <>
    Signed-off-by: Jonathan Nieder <>
    Signed-off-by: Junio C Hamano <>
Something went wrong with that request. Please try again.