rev-parse: check lookup'ed commit references for NULL
Commits 2122f8b963d4 ("rev-parse: Add support for the ^! and ^@ syntax", 2008-07-26) and 3dd4e7320d ("Teach rev-parse the ... syntax.", 2006-07-04) taught rev-parse new syntax, and used lookup_commit_reference() as part of their logic. Neither usage checked the returned commit to see if it was non-NULL before using it. Check for NULL and ensure an appropriate error is reported to the user. Reported by Florian Weimer and Todd Zullinger. Helped-by: Jeff King <peff@peff.net> Signed-off-by: Elijah Newren <newren@gmail.com> Reviewed-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Elijah Newren committed
May 23, 2018 at 23:27 UTC
0ed556d38f90f940fdd2d9e6360b4a7544cd34e8
2 files changed
+14
-2
builtin/rev-parse.c
+6
-2
@@ -282,6 +282,10 @@ static int try_difference(const char *arg)
282
struct commit *a, *b;
283
a = lookup_commit_reference(&oid);
284
b = lookup_commit_reference(&end);
285
+ if (!a || !b) {
286
+ *dotdot = '.';
287
+ return 0;
288
+ }
289
exclude = get_merge_bases(a, b);
290
while (exclude) {
291
struct commit *commit = pop_commit(&exclude);
@@ -328,12 +332,12 @@ static int try_parent_shorthands(const char *arg)
332
return 0;
333
334
*dotdot = 0;
331
- if (get_oid_committish(arg, &oid)) {
335
+ if (get_oid_committish(arg, &oid) ||
336
+ !(commit = lookup_commit_reference(&oid))) {
337
*dotdot = '^';
338
return 0;
339
}
340
336
- commit = lookup_commit_reference(&oid);
341
if (exclude_parent &&
342
exclude_parent > commit_list_count(commit->parents)) {
343
*dotdot = '^';
t/t6101-rev-parse-parents.sh
+8
@@ -214,4 +214,12 @@ test_expect_success 'rev-list merge^-1x (garbage after ^-1)' '
214
test_must_fail git rev-list merge^-1x
215
'
216
217
+test_expect_success 'rev-parse $garbage^@ does not segfault' '
218
+ test_must_fail git rev-parse $EMPTY_TREE^@
219
+'
220
+
221
+test_expect_success 'rev-parse $garbage...$garbage does not segfault' '
222
+ test_must_fail git rev-parse $EMPTY_TREE...$EMPTY_BLOB
223
+'
224
+
225
test_done