Fix use after free() in builtin-fetch

As reported by Dave Jones: Since master.kernel.org updated to latest, I noticed that I could crash git-fetch by doing this.. export KERNEL=/pub/scm/linux/kernel/git/ git fetch $KERNEL/torvalds/linux-2.6 master:linus (gdb) bt 0 0x000000349fd6d44b in free () from /lib64/libc.so.6 1 0x000000000048f4eb in transport_unlock_pack (transport=0x7ce530) at transport.c:811 2 0x000000349fd31b25 in exit () from /lib64/libc.so.6 3 0x00000000004043d8 in handle_internal_command (argc=3, argv=0x7fffea4449f0) at git.c:379 4 0x0000000000404547 in main (argc=3, argv=0x7fffea4449f0) at git.c:443 5 0x000000349fd1c784 in __libc_start_main () from /lib64/libc.so.6 6 0x0000000000403ef9 in ?? () 7 0x00007fffea4449d8 in ?? () 8 0x0000000000000000 in ?? () I then remembered, my .bashrc has this.. export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) which is handy for showing up such bugs. More info on this glibc feature is at http://udrepper.livejournal.com/11429.html Signed-off-by: Alex Riesen <raa.lkml@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Alex Riesen committed Apr 28, 2008 at 22:23 UTC 7b7f39eae6ab0bbcc68d3c42a5b23595880e528f

1 file changed +5 -3

builtin-fetch.c

+5 -3

@@ -577,8 +577,6 @@ static int do_fetch(struct transport *transport,

577 free_refs(ref_map);

578 }

579

580 - transport_disconnect(transport);

581 -

580 return 0;

581 }

582

@@ -599,6 +597,7 @@ int cmd_fetch(int argc, const char **argv, const char *prefix)

597 int i;

598 static const char **refs = NULL;

599 int ref_nr = 0;

600 + int exit_code;

601

602 /* Record the command line for the reflog */

603 strbuf_addstr(&default_rla, "fetch");

@@ -652,6 +651,9 @@ int cmd_fetch(int argc, const char **argv, const char *prefix)

651

652 signal(SIGINT, unlock_pack_on_signal);

653 atexit(unlock_pack);

655 - return do_fetch(transport,

654 + exit_code = do_fetch(transport,

655 parse_fetch_refspec(ref_nr, refs), ref_nr);

656 + transport_disconnect(transport);

657 + transport = NULL;

658 + return exit_code;

659 }