From d0cf51e9401b6486aaecfea5dc3b01c3bb00f271 Mon Sep 17 00:00:00 2001 From: Michael Haggerty Date: Mon, 15 Jul 2013 17:24:17 +0200 Subject: [PATCH] do_one_ref(): save and restore value of current_ref MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit If do_one_ref() is called recursively, then the inner call should not permanently overwrite the value stored in current_ref by the outer call. Aside from the tiny optimization loss, peel_ref() expects the value of current_ref not to change across a call to peel_entry(). But in the presence of replace references that assumption could be violated by a recursive call to do_one_ref: do_for_each_entry() do_one_ref() builtin/describe.c:get_name() peel_ref() peel_entry() peel_object () deref_tag_noverify() parse_object() lookup_replace_object() do_lookup_replace_object() prepare_replace_object() do_for_each_ref() do_for_each_entry() do_for_each_entry_in_dir() do_one_ref() The inner call to do_one_ref() was unconditionally setting current_ref to NULL when it was done, causing peel_ref() to perform an invalid memory access. So change do_one_ref() to save the old value of current_ref before overwriting it, and restore the old value afterward rather than setting it to NULL. Reported-by: Mantas Mikulėnas Signed-off-by: Michael Haggerty Signed-off-by: Junio C Hamano --- refs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/refs.c b/refs.c index d17931a8bc..f8ad1d608c 100644 --- a/refs.c +++ b/refs.c @@ -630,7 +630,9 @@ struct ref_entry_cb { static int do_one_ref(struct ref_entry *entry, void *cb_data) { struct ref_entry_cb *data = cb_data; + struct ref_entry *old_current_ref; int retval; + if (prefixcmp(entry->name, data->base)) return 0; @@ -638,10 +640,12 @@ static int do_one_ref(struct ref_entry *entry, void *cb_data) !ref_resolves_to_object(entry)) return 0; + /* Store the old value, in case this is a recursive call: */ + old_current_ref = current_ref; current_ref = entry; retval = data->fn(entry->name + data->trim, entry->u.value.sha1, entry->flag, data->cb_data); - current_ref = NULL; + current_ref = old_current_ref; return retval; } -- 2.11.4.GIT