ref-filter: fix memory leak in `free_array_item()`
We treat the `value` pointer as a pointer to a struct and free its `s` field. But `value` is in fact an array of structs. As a result, we only free the first `s` out of `used_atom_cnt`-many and leak the rest. Make sure we free all items in `value`. In the caller, `ref_array_clear()`, this means we need to be careful not to zero `used_atom_cnt` until after we've called `free_array_item()`. We could move just a single line, but let's keep related things close together instead, by first handling `array`, then `used_atom`. Signed-off-by: Martin Ågren <martin.agren@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Martin Ågren committed
Jul 10, 2019 at 20:36 UTC
14d30cdfc047fdff33c359f17cbb070f2faed009
1 file changed
+9
-5
ref-filter.c
+9
-5
@@ -2105,7 +2105,9 @@ static void free_array_item(struct ref_array_item *item)
2105
{
2106
free((char *)item->symref);
2107
if (item->value) {
2108
- free((char *)item->value->s);
2108
+ int i;
2109
+ for (i = 0; i < used_atom_cnt; i++)
2110
+ free((char *)item->value[i].s);
2111
free(item->value);
2112
}
2113
free(item);
@@ -2116,14 +2118,16 @@ void ref_array_clear(struct ref_array *array)
2118
{
2119
int i;
2120
2119
- for (i = 0; i < used_atom_cnt; i++)
2120
- free((char *)used_atom[i].name);
2121
- FREE_AND_NULL(used_atom);
2122
- used_atom_cnt = 0;
2121
for (i = 0; i < array->nr; i++)
2122
free_array_item(array->items[i]);
2123
FREE_AND_NULL(array->items);
2124
array->nr = array->alloc = 0;
2125
+
2126
+ for (i = 0; i < used_atom_cnt; i++)
2127
+ free((char *)used_atom[i].name);
2128
+ FREE_AND_NULL(used_atom);
2129
+ used_atom_cnt = 0;
2130
+
2131
if (ref_to_worktree_map.worktrees) {
2132
hashmap_free(&(ref_to_worktree_map.map), 1);
2133
free_worktrees(ref_to_worktree_map.worktrees);