grep: report missing left operand of --and

Git grep allows combining two patterns with --and.  It checks and
reports if the second pattern is missing when compiling the expression.
A missing first pattern, however, is only reported later at match time.
Thus no error is returned if no matching is done, e.g. because no file
matches the also given pathspec.

When that happens we get an expression tree with an GREP_NODE_AND node
and a NULL pointer to the missing left child.  free_pattern_expr()
tries to dereference it during the cleanup at the end, which results
in a segmentation fault.

Fix this by verifying the presence of the left operand at expression
compilation time.

Reported-by: Matthew Hughes <matthewhughes934@gmail.com>
Helped-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: René Scharfe <l.s.r@web.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/grep.c b/grep.c
index 4db1510d167c9fc3cc7b129c90aa874a4c7c2b0f..71e44402dc439fb6985f1aca9794c6f52d29cc09 100644 (file)
--- a/grep.c
+++ b/grep.c
@@ -774,6 +774,8 @@ static struct grep_expr *compile_pattern_and(struct grep_pat **list)
        x = compile_pattern_not(list);
        p = *list;
        if (p && p->token == GREP_AND) {
+               if (!x)
+                       die("--and not preceded by pattern expression");
                if (!p->next)
                        die("--and not followed by pattern expression");
                *list = p->next;

diff --git a/t/t7810-grep.sh b/t/t7810-grep.sh
index 43aa4161cf030b4c58ab2785e0bffc6635127a5f..47434e668713ab5c8b37e5a23513c7eea142fc7a 100755 (executable)
--- a/t/t7810-grep.sh
+++ b/t/t7810-grep.sh
@@ -8,6 +8,13 @@ test_description='git grep various.
 
 . ./test-lib.sh
 
+test_invalid_grep_expression() {
+       params="$@" &&
+       test_expect_success "invalid expression: grep $params" '
+               test_must_fail git grep $params -- nonexisting
+       '
+}
+
 cat >hello.c <<EOF
 #include <assert.h>
 #include <stdio.h>
@@ -81,6 +88,8 @@ test_expect_success 'grep should not segfault with a bad input' '
        test_must_fail git grep "("
 '
 
+test_invalid_grep_expression --and -e A
+
 for H in HEAD ''
 do
        case "$H" in