@matheusbsbs / matheus-bagliano / commits / 7865d157a5

refspec: initalize `refspec_item` in `valid_fetch_refspec()`

We allocate a `struct refspec_item` on the stack without initializing it. In particular, its `dst` and `src` members will contain some random data from the stack. When we later call `refspec_item_clear()`, it will call `free()` on those pointers. So if the call to `parse_refspec()` did not assign to them, we will be freeing some random "pointers". This is undefined behavior. To the best of my understanding, this cannot currently be triggered by user-provided data. And for what it's worth, the test-suite does not trigger this with SANITIZE=address. It can be provoked by calling `valid_fetch_refspec(":*")`. Zero the struct, as is done in other users of `struct refspec_item` by using the refspec_item_init() initialization function. Signed-off-by: Martin Ågren <martin.agren@gmail.com> Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Martin Ågren committed Jun 5, 2018 at 19:54 UTC 7865d157a5e8d86f46e626d933bda5c18eab196a

1 file changed +1 -1

refspec.c

+1 -1

@@ -194,7 +194,7 @@ void refspec_clear(struct refspec *rs)

194 int valid_fetch_refspec(const char *fetch_refspec_str)

195 {

196 struct refspec_item refspec;

197 - int ret = parse_refspec(&refspec, fetch_refspec_str, REFSPEC_FETCH);

197 + int ret = refspec_item_init(&refspec, fetch_refspec_str, REFSPEC_FETCH);

198 refspec_item_clear(&refspec);

199 return ret;

200 }