From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 4 Oct 2024 04:58:53 +0000 (+0200)
Subject: reftable/basics: fix segfault when growing `names` array fails
X-Git-Tag: v2.48.0-rc0~130^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2179b5c831f6bc286acda15c7c7f4a573291ee5c;p=thirdparty%2Fgit.git

reftable/basics: fix segfault when growing `names` array fails

When growing the `names` array fails we would end up with a `NULL`
pointer. This causes two problems:

  - We would run into a segfault because we try to free names that we
    have assigned to the array already.

  - We lose track of the old array and cannot free its contents.

Fix this issue by using a temporary variable. Like this we do not
clobber the old array that we tried to reallocate, which will remain
valid when a call to realloc(3P) fails.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---

diff --git a/reftable/basics.c b/reftable/basics.c
index c8396dc525..9a949e5cf8 100644
--- a/reftable/basics.c
+++ b/reftable/basics.c
@@ -152,9 +152,11 @@ char **parse_names(char *buf, int size)
 			next = end;
 		}
 		if (p < next) {
-			REFTABLE_ALLOC_GROW(names, names_len + 1, names_cap);
-			if (!names)
+			char **names_grown = names;
+			REFTABLE_ALLOC_GROW(names_grown, names_len + 1, names_cap);
+			if (!names_grown)
 				goto err;
+			names = names_grown;
 
 			names[names_len] = reftable_strdup(p);
 			if (!names[names_len++])