remote: fix use-after-free error detected by glibc in ref_remove_duplicates
In ref_remove_duplicates, when we encounter a duplicate and remove it from the list we need to make sure that the prev pointer stays pointing at the last entry and also skip over adding the just freed entry to the string_list. Previously fetch could crash with: *** glibc detected *** git: corrupted double-linked list: ... Also add a test to try and catch problems with duplicate removal in the future. Acked-by: Nicolas Pitre <nico@fluxnic.net> Signed-off-by: Julian Phillips <julian@quantumfyre.co.uk> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Julian Phillips committed
Nov 13, 2009 at 21:25 UTC
95c96d48e65a597cfd2bf7228ddc8c7ca30b55b7
2 files changed
+13
remote.c
+2
@@ -754,6 +754,8 @@ void ref_remove_duplicates(struct ref *ref_map)
754
prev->next = ref_map->next;
755
free(ref_map->peer_ref);
756
free(ref_map);
757
+ ref_map = prev; /* skip this; we freed it */
758
+ continue;
759
}
760
761
item = string_list_insert(ref_map->peer_ref->name, &refs);
t/t5510-fetch.sh
+11
@@ -341,4 +341,15 @@ test_expect_success 'fetch into the current branch with --update-head-ok' '
341
342
'
343
344
+test_expect_success "should be able to fetch with duplicate refspecs" '
345
+ mkdir dups &&
346
+ cd dups &&
347
+ git init &&
348
+ git config branch.master.remote three &&
349
+ git config remote.three.url ../three/.git &&
350
+ git config remote.three.fetch +refs/heads/*:refs/remotes/origin/* &&
351
+ git config --add remote.three.fetch +refs/heads/*:refs/remotes/origin/* &&
352
+ git fetch three
353
+'
354
+
355
test_done