@matheusbsbs / matheus-bagliano / commits / 89f45cf4eb

format-patch: don't leak "extra_headers" or "ref_message_ids"

Fix two memory leaks in "struct rev_info" by freeing that memory in cmd_format_patch(). These two are unusual special-cases in being in the "struct rev_info", but not being "owned" by the code in revision.c. I.e. they're members of the struct so that this code in "builtin/log.c" can conveniently pass information code in "log-tree.c". See e.g. the make_cover_letter() caller of log_write_email_headers() here in "builtin/log.c", and [1] for a demonstration of where the "extra_headers" and "ref_message_ids" struct members are used. See 20ff06805c6 (format-patch: resurrect extra headers from config, 2006-06-02) and d1566f7883f (git-format-patch: Make the second and subsequent mails replies to the first, 2006-07-14) for the initial introduction of "extra_headers" and "ref_message_ids". We can count on repo_init_revisions() memset()-ing this data to 0 however, so we can count on it being either NULL or something we allocated. In the case of "extra_headers" let's add a local "char *" variable to hold it, to avoid the eventual cast from "const char *" when we free() it. 1. https://lore.kernel.org/git/220401.868rsoogxf.gmgdl@evledraar.gmail.com/ Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ævar Arnfjörð Bjarmason committed Apr 13, 2022 at 22:01 UTC 89f45cf4eb031f28b5dd028983734c4ddfa99439

1 file changed +6 -1

builtin/log.c

+6 -1

@@ -1747,6 +1747,7 @@ int cmd_format_patch(int argc, const char **argv, const char *prefix)

1747 struct commit *commit;

1748 struct commit **list = NULL;

1749 struct rev_info rev;

1750 + char *to_free = NULL;

1751 struct setup_revision_opt s_r_opt;

1752 int nr = 0, total, i;

1753 int use_stdout = 0;

@@ -1947,7 +1948,7 @@ int cmd_format_patch(int argc, const char **argv, const char *prefix)

1948 strbuf_addch(&buf, '\n');

1949 }

1950

1950 - rev.extra_headers = strbuf_detach(&buf, NULL);

1951 + rev.extra_headers = to_free = strbuf_detach(&buf, NULL);

1952

1953 if (from) {

1954 if (split_ident_line(&rev.from_ident, from, strlen(from)))

@@ -2284,6 +2285,10 @@ done:

2285 strbuf_release(&rdiff1);

2286 strbuf_release(&rdiff2);

2287 strbuf_release(&rdiff_title);

2288 + free(to_free);

2289 + if (rev.ref_message_ids)

2290 + string_list_clear(rev.ref_message_ids, 0);

2291 + free(rev.ref_message_ids);

2292 UNLEAK(rev);

2293 return 0;

2294 }