From: Johannes Schindelin Date: Fri, 10 Jul 2026 11:39:30 +0000 (+0000) Subject: bisect: handle NULL commit in `bisect_successful()` X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=74fb18824cda5f28811e5d5e4653434f01238133;p=thirdparty%2Fgit.git bisect: handle NULL commit in `bisect_successful()` When `lookup_commit_reference_by_name()` is called to find the first bad commit, the result is passed to `repo_format_commit_message()` immediately, which dereferences commit without checking for NULL. However, the commit could be NULL, even though in practice this is unlikely because `bisect_successful()` is only called after a successful bisect run has identified the bad commit, but the ref could still become dangling due to a concurrent gc or repository corruption. Pointed out by Coverity. Assisted-by: Claude Opus 4.6 Signed-off-by: Johannes Schindelin Signed-off-by: Junio C Hamano --- diff --git a/builtin/bisect.c b/builtin/bisect.c index 798e28f501..2672cbe5d1 100644 --- a/builtin/bisect.c +++ b/builtin/bisect.c @@ -663,6 +663,11 @@ static int bisect_successful(struct bisect_terms *terms) refs_read_ref(get_main_ref_store(the_repository), bad_ref, &oid); commit = lookup_commit_reference_by_name(bad_ref); + if (!commit) { + error(_("could not find commit for '%s'"), bad_ref); + free(bad_ref); + return BISECT_FAILED; + } repo_format_commit_message(the_repository, commit, "%s", &commit_name, &pp);