@matheusbsbs / matheus-bagliano / commits / 8e92e8f242

parse_object_buffer: correct freeing the buffer

If we exit early in the function parse_object_buffer, we did not write to *eaten_p. Then the calling function parse_object, which looks like the following with respect to the eaten variable, cannot rely on a proper value set in eaten, hence the freeing of the buffer depends on random values in memory. struct object *parse_object(const unsigned char *sha1) { int eaten; ... obj = parse_object_buffer(sha1, type, size, buffer, &eaten); if (!eaten) free(buffer); } This change makes sure, the buffer freeing condition is deterministic. Signed-off-by: Stefan Beller <stefanbeller@googlemail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Stefan Beller committed Jul 18, 2013 at 00:09 UTC 8e92e8f2422a5805916e5e14c6bebfd82467e044

1 file changed +3 -4

object.c

+3 -4

@@ -135,7 +135,7 @@ struct object *lookup_unknown_object(const unsigned char *sha1)

135 struct object *parse_object_buffer(const unsigned char *sha1, enum object_type type, unsigned long size, void *buffer, int *eaten_p)

136 {

137 struct object *obj;

138 - int eaten = 0;

138 + *eaten_p = 0;

139

140 obj = NULL;

141 if (type == OBJ_BLOB) {

@@ -154,7 +154,7 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t

154 if (!tree->object.parsed) {

155 if (parse_tree_buffer(tree, buffer, size))

156 return NULL;

157 - eaten = 1;

157 + *eaten_p = 1;

158 }

159 }

160 } else if (type == OBJ_COMMIT) {

@@ -164,7 +164,7 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t

164 return NULL;

165 if (!commit->buffer) {

166 commit->buffer = buffer;

167 - eaten = 1;

167 + *eaten_p = 1;

168 }

169 obj = &commit->object;

170 }

@@ -181,7 +181,6 @@ struct object *parse_object_buffer(const unsigned char *sha1, enum object_type t

181 }

182 if (obj && obj->type == OBJ_NONE)

183 obj->type = type;

184 - *eaten_p = eaten;

184 return obj;

185 }

186