[pull] master from git:master - #251
Merged
Merged
Conversation
When a ":<path>" argument names a relative path, resolve_relative_path()
returns a newly allocated string and "cp" is pointed at it:
new_path = resolve_relative_path(repo, cp);
if (!new_path) {
namelen = namelen - (cp - name);
} else {
cp = new_path;
namelen = strlen(cp);
}
From there on "cp" and "new_path" name the same allocation. Later the
memory location that "new_path" points to is freed.
free(new_path);
if (reject_tree_in_index(repo, only_to_die, ce, stage, prefix, cp))
But here the reject_tree_in_index() passes "cp" to
diagnose_invalid_index_path(), which calls strlen() on it, looks it up
in the index, and formats it into its messages, allocating as it goes.
All of this reads memory that has already been freed.
Collapse the two exits into one to ensure a single free() that happens
after the last use.
Three things have to coincide to reach this:
1. The path has to be relative, or nothing is allocated and "cp"
still points into the argument.
2. The entry found has to be a sparse
directory, which needs a sparse index.
3. The argument has to get past the check in die_verify_filename() that
skips a leading ':' followed by a non-alphanumeric, so ":0:./dir/"
arrives here where ":./dir/" does not.
Add a test to t1092 that covers the combination. It fails under
SANITIZE=address without the change to object-name.c.
This was reported in [1], and the shape used here was suggested in
review [2], but that series was not rerolled and the fix never landed.
[1] https://lore.kernel.org/git/cf6bcdb43e5b4abab464c30a914d64dc8e7a9925.1655336146.git.gitgitgadget@gmail.com/
[2] https://lore.kernel.org/git/xmqqy1xxw7rc.fsf@gitster.g/
Reported-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Original-patch-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Helped-by: Junio C Hamano <gitster@pobox.com>
Suggested-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Shlok Kulshreshtha <diy2903@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
We first talk about just `%s`, but then show the result with
quotes. That is inconsistent. Let’s use quotes both in the format
as well as in the result.
The implied input here, which is not spelled out for brevity, is:
Did we not fix this in <commit object name>?
Which is then supposed to be formatted to `"<subject>"`.
Signed-off-by: Kristoffer Haugsbakk <code@khaugsbakk.name>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This code block uses the placeholder `<subject>`. Let’s highlight this placeholder properly by using the `synopsis` open block definition which was introduced in a34d1d5 (doc: convert git-show to synopsis style, 2026-02-06). This renders the block like a code block but with emphasis styling on placeholders, just like inline-verbatim (`) in running text. Yes, note that open blocks since commit a34d1d5 can, on synopsis-style docs like this one, be immediately preceded by `[synopsis]`, just like the command synopsis is: [synopsis] (EXPERIMENTAL!) git format-rev - [...] Cf. verse-style: [verse] 'git name-rev' [...] Signed-off-by: Kristoffer Haugsbakk <code@khaugsbakk.name> Signed-off-by: Junio C Hamano <gitster@pobox.com>
The documentation for 'git format-rev' has been updated to use the [synopsis] block definition on code blocks to properly highlight placeholders, and a quoting inconsistency in the running text has been fixed. * kh/format-rev-doc-synopsis: doc: format-rev: use [synopsis] on code block doc: format-rev: quote subject placeholder before and after
A heap-use-after-free bug in the object name parsing code when reporting failures with a relative path to a sparse directory has been corrected. * sk/object-name-use-after-free: object-name: avoid use-after-free in get_oid_with_context_1()
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )