]> git.ipfire.org Git - thirdparty/git.git/commit - notes.c
notes: avoid potential use-after-free during insertion
authorJeff King <peff@peff.net>
Sun, 25 Aug 2019 07:19:51 +0000 (03:19 -0400)
committerJunio C Hamano <gitster@pobox.com>
Mon, 26 Aug 2019 17:29:56 +0000 (10:29 -0700)
commit60fe477a0be2a3801e5ce3913e0be8e8e2e58e4f
tree3233bf20b5adeb58359de561a7a57b3432bfe146
parent779ad6641b9a6443eaec75439b3374b1a7b8794c
notes: avoid potential use-after-free during insertion

The note_tree_insert() function may free the leaf_node struct we pass in
(e.g., if it's a duplicate, or if it needs to be combined with an
existing note).

Most callers are happy with this, as they assume that ownership of the
struct is handed off. But in load_subtree(), if we see an error we'll
use the handed-off struct's key_oid to generate the die() message,
potentially accessing freed memory.

We can easily fix this by instead using the original oid that we copied
into the leaf_node struct.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
notes.c