mirrors/git
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Copy resolve_ref() return value for longer use

Browse Source 
resolve_ref() may return a pointer to a static buffer. Callers that
use this value longer than a couple of statements should copy the
value to avoid some hidden resolve_ref() call that may change the
static buffer's value.

The bug found by Tony Wang <wwwjfy@gmail.com> in builtin/merge.c
demonstrates this. The first call is in cmd_merge()

branch = resolve_ref("HEAD", head_sha1, 0, &flag);

Then deep in lookup_commit_or_die() a few lines after, resolve_ref()
may be called again and destroy "branch".

lookup_commit_or_die
 lookup_commit_reference
  lookup_commit_reference_gently
   parse_object
    lookup_replace_object
     do_lookup_replace_object
      prepare_replace_object
       for_each_replace_ref
        do_for_each_ref
         get_loose_refs
          get_ref_dir
           get_ref_dir
            resolve_ref

All call sites are checked and made sure that xstrdup() is called if
the value should be saved.

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
Nguyễn Thái Ngọc Duy
2011-11-13 17:22:15 +07:00
committed by Junio C Hamano
parent c689332391
commit d5a35c114a
8 changed files with 66 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
builtin/merge.c
View File

@ -1082,7 +1082,7 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
struct commit *head_commit;
struct strbuf buf = STRBUF_INIT;
const char *head_arg;
int flag, i;
int flag, i, ret = 0;
int best_cnt = -1, merge_was_ok = 0, automerge_was_ok = 0;
struct commit_list *common = NULL;
const char *best_strategy = NULL, *wt_strategy = NULL;
@ -1096,8 +1096,11 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
* current branch.
*/
branch = resolve_ref("HEAD", head_sha1, 0, &flag);
if (branch && !prefixcmp(branch, "refs/heads/"))
branch += 11;
if (branch) {
if (!prefixcmp(branch, "refs/heads/"))
branch += 11;
branch = xstrdup(branch);
}
if (!branch || is_null_sha1(head_sha1))
head_commit = NULL;
else
@ -1121,7 +1124,8 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
die(_("There is no merge to abort (MERGE_HEAD missing)."));
/* Invoke 'git reset --merge' */
return cmd_reset(nargc, nargv, prefix);
ret = cmd_reset(nargc, nargv, prefix);
goto done;
}
if (read_cache_unmerged())
@ -1205,7 +1209,7 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
read_empty(remote_head->sha1, 0);
update_ref("initial pull", "HEAD", remote_head->sha1, NULL, 0,
DIE_ON_ERR);
return 0;
goto done;
} else {
struct strbuf merge_names = STRBUF_INIT;
@ -1292,7 +1296,7 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
* but first the most common case of merging one remote.
*/
finish_up_to_date("Already up-to-date.");
return 0;
goto done;
} else if (allow_fast_forward && !remoteheads->next &&
!common->next &&
!hashcmp(common->item->object.sha1, head_commit->object.sha1)) {
@ -1313,15 +1317,20 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
strbuf_addstr(&msg,
" (no commit created; -m option ignored)");
o = want_commit(sha1_to_hex(remoteheads->item->object.sha1));
if (!o)
return 1;
if (!o) {
ret = 1;
goto done;
}
if (checkout_fast_forward(head_commit->object.sha1, remoteheads->item->object.sha1))
return 1;
if (checkout_fast_forward(head_commit->object.sha1,
remoteheads->item->object.sha1)) {
ret = 1;
goto done;
}
finish(head_commit, o->sha1, msg.buf);
drop_save();
return 0;
goto done;
} else if (!remoteheads->next && common->next)
;
/*
@ -1339,8 +1348,11 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
git_committer_info(IDENT_ERROR_ON_NO_NAME);
printf(_("Trying really trivial in-index merge...\n"));
if (!read_tree_trivial(common->item->object.sha1,
head_commit->object.sha1, remoteheads->item->object.sha1))
return merge_trivial(head_commit);
head_commit->object.sha1,
remoteheads->item->object.sha1)) {
ret = merge_trivial(head_commit);
goto done;
}
printf(_("Nope.\n"));
}
} else {
@ -1368,7 +1380,7 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
}
if (up_to_date) {
finish_up_to_date("Already up-to-date. Yeeah!");
return 0;
goto done;
}
}
@ -1450,9 +1462,11 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
* If we have a resulting tree, that means the strategy module
* auto resolved the merge cleanly.
*/
if (automerge_was_ok)
return finish_automerge(head_commit, common, result_tree,
wt_strategy);
if (automerge_was_ok) {
ret = finish_automerge(head_commit, common, result_tree,
wt_strategy);
goto done;
}
/*
* Pick the result from the best strategy and have the user fix
@ -1466,7 +1480,8 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
else
fprintf(stderr, _("Merge with strategy %s failed.\n"),
use_strategies[0]->name);
return 2;
ret = 2;
goto done;
} else if (best_strategy == wt_strategy)
; /* We already have its result in the working tree. */
else {
@ -1482,10 +1497,13 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
else
write_merge_state();
if (merge_was_ok) {
if (merge_was_ok)
fprintf(stderr, _("Automatic merge went well; "
"stopped before committing as requested\n"));
return 0;
} else
return suggest_conflicts(option_renormalize);
else
ret = suggest_conflicts(option_renormalize);
done:
free((char *)branch);
return ret;
}