pathspec: fix segfault in clear_pathspec
In 'clear_pathspec()' the incorrect index parameter is used to bound an inner-loop which is used to free a 'struct attr_match' value field. Using the incorrect index parameter (in addition to being incorrect) occasionally causes segmentation faults when attempting to free an invalid pointer. Fix this by using the correct index parameter 'i'. Signed-off-by: Brandon Williams <bmwill@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Brandon Williams committed
Apr 7, 2017 at 12:29 UTC
5ce10c0a29efeab21567228f8916190f2202fdb3
1 file changed
+1
-1
pathspec.c
+1
-1
@@ -724,7 +724,7 @@ void clear_pathspec(struct pathspec *pathspec)
724
free(pathspec->items[i].match);
725
free(pathspec->items[i].original);
726
727
- for (j = 0; j < pathspec->items[j].attr_match_nr; j++)
727
+ for (j = 0; j < pathspec->items[i].attr_match_nr; j++)
728
free(pathspec->items[i].attr_match[j].value);
729
free(pathspec->items[i].attr_match);
730