commit-reach: avoid NULL dereference
The loop at the top of can_all_from_reach_with_flag() already accounts for `from->objects[i].item' being NULL, so it follows the cleanup loop should also account for a NULL `from_one'. I managed to segfault here on one of my giant, many-remote repos using `git fetch --negotiation-tip=... --negotiation-only' where the --negotiation-tip= argument was a glob which (inadvertently) captured more refs than I wanted. I have not reproduced this in a standalone test case. Signed-off-by: Eric Wong <e@80x24.org> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Eric Wong committed
Feb 11, 2023 at 11:15 UTC
c5773dc078f05a98c9359938dbce3b3dc70aa3bd
1 file changed
+6
-2
commit-reach.c
+6
-2
@@ -628,8 +628,12 @@ cleanup:
628
}
629
free(list);
630
631
- for (i = 0; i < from->nr; i++)
632
- from->objects[i].item->flags &= ~assign_flag;
631
+ for (i = 0; i < from->nr; i++) {
632
+ struct object *from_one = from->objects[i].item;
633
+
634
+ if (from_one)
635
+ from_one->flags &= ~assign_flag;
636
+ }
637
638
return result;
639
}