From: Martin Ågren Date: Tue, 5 Jun 2018 19:54:40 +0000 (+0000) Subject: refspec: initalize `refspec_item` in `valid_fetch_refspec()` X-Git-Tag: v2.19.0-rc0~179^2 X-Git-Url: http://git.bitbasher.net/?a=commitdiff_plain;h=7865d157a5e8d86f46e626d933bda5c18eab196a;p=git.git refspec: initalize `refspec_item` in `valid_fetch_refspec()` We allocate a `struct refspec_item` on the stack without initializing it. In particular, its `dst` and `src` members will contain some random data from the stack. When we later call `refspec_item_clear()`, it will call `free()` on those pointers. So if the call to `parse_refspec()` did not assign to them, we will be freeing some random "pointers". This is undefined behavior. To the best of my understanding, this cannot currently be triggered by user-provided data. And for what it's worth, the test-suite does not trigger this with SANITIZE=address. It can be provoked by calling `valid_fetch_refspec(":*")`. Zero the struct, as is done in other users of `struct refspec_item` by using the refspec_item_init() initialization function. Signed-off-by: Martin Ågren Signed-off-by: Ævar Arnfjörð Bjarmason Signed-off-by: Junio C Hamano --- diff --git a/refspec.c b/refspec.c index 597ddf8b52..e4c9e86bb6 100644 --- a/refspec.c +++ b/refspec.c @@ -194,7 +194,7 @@ void refspec_clear(struct refspec *rs) int valid_fetch_refspec(const char *fetch_refspec_str) { struct refspec_item refspec; - int ret = parse_refspec(&refspec, fetch_refspec_str, REFSPEC_FETCH); + int ret = refspec_item_init(&refspec, fetch_refspec_str, REFSPEC_FETCH); refspec_item_clear(&refspec); return ret; }