do_one_ref(): save and restore value of current_ref
commitd0cf51e9401b6486aaecfea5dc3b01c3bb00f271
authorMichael Haggerty <mhagger@alum.mit.edu>
Mon, 15 Jul 2013 15:24:17 +0000 (15 17:24 +0200)
committerJunio C Hamano <gitster@pobox.com>
Thu, 18 Jul 2013 01:19:16 +0000 (17 18:19 -0700)
tree02e8d69901e235a0a087aff1c0e6eada091c9895
parent2f1ef15070a8664d3194d164f20283d78571e51c
do_one_ref(): save and restore value of current_ref

If do_one_ref() is called recursively, then the inner call should not
permanently overwrite the value stored in current_ref by the outer
call.  Aside from the tiny optimization loss, peel_ref() expects the
value of current_ref not to change across a call to peel_entry().  But
in the presence of replace references that assumption could be
violated by a recursive call to do_one_ref:

do_for_each_entry()
  do_one_ref()
    builtin/describe.c:get_name()
      peel_ref()
        peel_entry()
          peel_object ()
            deref_tag_noverify()
              parse_object()
                lookup_replace_object()
                  do_lookup_replace_object()
                    prepare_replace_object()
                      do_for_each_ref()
                        do_for_each_entry()
                          do_for_each_entry_in_dir()
                            do_one_ref()

The inner call to do_one_ref() was unconditionally setting current_ref
to NULL when it was done, causing peel_ref() to perform an invalid
memory access.

So change do_one_ref() to save the old value of current_ref before
overwriting it, and restore the old value afterward rather than
setting it to NULL.

Reported-by: Mantas Mikulėnas <grawity@gmail.com>
Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
refs.c