send-pack: fix memory leak around duplicate refs

The 'git-send-pack(1)' allows users to push objects to a remote repository and explicitly list the references to be pushed. The status of each reference pushed is captured into a list mapped by refname. If a reference fails to be updated, its error message is captured in the `ref->remote_status` field. While the command allows duplicate ref inputs, the list doesn't accommodate this behavior as a particular refname is linked to a single `struct ref*` element. So if the user inputs a reference twice like: git send-pack remote.git A:foo B:foo where the user is trying to update the same reference 'foo' twice and the reference fails to be updated, we first fill `ref->remote_status` with error message for the input 'A:foo' then we override the same field with the error message for 'B:foo'. This override happens without first free'ing the previous value. Fix this leak. The current tests already incorporate the above example, but in the test 'A:foo' succeeds while 'B:foo' fails, meaning that the memory leak isn't triggered. Add a new test with multiple duplicates. Signed-off-by: Karthik Nayak <karthik.188@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Karthik Nayak committed May 19, 2025 at 11:58 UTC 77188b5bbaf1f77963968ea3acedda3108102b18
2 files changed +13
send-pack.c
+7
@@ -257,6 +257,13 @@ static int receive_status(struct repository *r,
257 refname);
258 continue;
259 }
260 +
261 + /*
262 + * Clients sending duplicate refs can cause the same value
263 + * to be overridden, causing a memory leak.
264 + */
265 + free(hint->remote_status);
266 +
267 if (!strcmp(head, "ng")) {
268 hint->status = REF_STATUS_REMOTE_REJECT;
269 if (p)
t/t5408-send-pack-stdin.sh
+6
@@ -73,6 +73,12 @@ test_expect_success 'cmdline refs written in order' '
73 verify_push A foo
74 '
75
76 +test_expect_success 'cmdline refs with multiple duplicates' '
77 + clear_remote &&
78 + test_must_fail git send-pack remote.git A:foo B:foo C:foo &&
79 + verify_push A foo
80 +'
81 +
82 test_expect_success '--stdin refs come after cmdline' '
83 clear_remote &&
84 echo A:foo >input &&