| commit | e1cb70dca81a97bb6dd9198923f5808c9031844b | |
| author | Nguyễn Thái Ngọc Duy <pclouds@gmail.com> | |
| Tue, 29 Jul 2014 13:50:28 +0000 (29 20:50 +0700) | ||
| committer | Junio C Hamano <gitster@pobox.com> | |
| Tue, 29 Jul 2014 20:42:13 +0000 (29 13:42 -0700) | ||
| tree | 2e20d43e2e087619b33cdf26377db132c857adc1 | treesnapshot (tar.gz zip) |
| parent | 5e9149417b92c51e58550fe58f10f05b6dd7d016 | commitdiff |
checkout --to: fix dangling pointers in remove_junk()
junk_git_dir is set to sb_repo.buf. By the end of prepare_linked_checkout(),
sb_repo is freed and so junk_git_dir points to nowhere. If the second
checkout command fails, is_junk remains non-zero, remove_junk() will
be called and try to clean junk_git_dir, which could be anything now
(if it does not crash the program).
The new test may pass even without this patch. But it does fail under
valgrind (without this patch) with "Invalid read of size 8" at the
right line.
Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
junk_git_dir is set to sb_repo.buf. By the end of prepare_linked_checkout(),
sb_repo is freed and so junk_git_dir points to nowhere. If the second
checkout command fails, is_junk remains non-zero, remove_junk() will
be called and try to clean junk_git_dir, which could be anything now
(if it does not crash the program).
The new test may pass even without this patch. But it does fail under
valgrind (without this patch) with "Invalid read of size 8" at the
right line.
Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
| builtin/checkout.c | diffblobblamehistory | |
| t/t2025-checkout-to.sh | diffblobblamehistory |