rebase: use child_process_clear() to clean

In the run_am() function, we set up a child_process struct to run "git-am", allocating memory for its args and env strvecs. These are normally cleaned up when we call run_command(). But if we encounter certain errors, we exit the function early and try to clean up ourselves by clearing the am.args field. This leaks the "env" strvec. We should use child_process_clear() instead, which covers both. And more importantly, it future proofs us against the struct ever growing more allocated fields. These are unlikely errors to happen in practice, so they don't actually trigger the leak sanitizer in the tests. But we can add a new test which does exercise one of the paths (and fails SANITIZE=leak without this patch). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed Mar 22, 2024 at 06:35 UTC 647e870a08e31984f5f42703f3618ff378a72932
2 files changed +12 -3
builtin/rebase.c
+3 -3
index 6635f10d52..acd083bec3 100644 --- a/builtin/rebase.c +++ b/builtin/rebase.c @@ -653,7 +653,7 @@ static int run_am(struct rebase_options *opts) status = error_errno(_("could not open '%s' for writing"), rebased_patches); free(rebased_patches); - strvec_clear(&am.args); + child_process_clear(&am); return status; } @@ -676,7 +676,7 @@ static int run_am(struct rebase_options *opts) struct reset_head_opts ropts = { 0 }; unlink(rebased_patches); free(rebased_patches); - strvec_clear(&am.args); + child_process_clear(&am); ropts.oid = &opts->orig_head->object.oid; ropts.branch = opts->head_name; @@ -699,7 +699,7 @@ static int run_am(struct rebase_options *opts) status = error_errno(_("could not open '%s' for reading"), rebased_patches); free(rebased_patches); - strvec_clear(&am.args); + child_process_clear(&am); return status; }
t/t3438-rebase-broken-files.sh
+9
index c614c4f2e4..821f08e5af 100755 --- a/t/t3438-rebase-broken-files.sh +++ b/t/t3438-rebase-broken-files.sh @@ -58,4 +58,13 @@ test_expect_success 'unknown key in author-script' ' check_resolve_fails ' +test_expect_success POSIXPERM,SANITY 'unwritable rebased-patches does not leak' ' + >.git/rebased-patches && + chmod a-w .git/rebased-patches && + + git checkout -b side HEAD^ && + test_commit unrelated && + test_must_fail git rebase --apply --onto tmp HEAD^ +' + test_done