init: make a copy of $GIT_DIR string
We pass the result of getenv("GIT_DIR") to init_db() and assume that the string remains valid. But that's not guaranteed across calls to setenv() or even getenv(), although it often works in practice. Let's make a copy of the string so that we follow the rules. Note that we need to mark it with UNLEAK(), since the value persists until the end of program (but we have no opportunity to free it). This patch also handles $GIT_WORK_TREE the same way. It actually doesn't have as long a lifetime and is probably fine, but it's simpler to just treat the two side-by-side variables the same. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Jan 11, 2019 at 17:16 UTC
e5b07c539deefb13a4830fe9303e3d7590713f26
1 file changed
+4
-2
builtin/init-db.c
+4
-2
@@ -541,8 +541,8 @@ int cmd_init_db(int argc, const char **argv, const char *prefix)
541
* GIT_WORK_TREE makes sense only in conjunction with GIT_DIR
542
* without --bare. Catch the error early.
543
*/
544
- git_dir = getenv(GIT_DIR_ENVIRONMENT);
545
- work_tree = getenv(GIT_WORK_TREE_ENVIRONMENT);
544
+ git_dir = xstrdup_or_null(getenv(GIT_DIR_ENVIRONMENT));
545
+ work_tree = xstrdup_or_null(getenv(GIT_WORK_TREE_ENVIRONMENT));
546
if ((!git_dir || is_bare_repository_cfg == 1) && work_tree)
547
die(_("%s (or --work-tree=<directory>) not allowed without "
548
"specifying %s (or --git-dir=<directory>)"),
@@ -581,6 +581,8 @@ int cmd_init_db(int argc, const char **argv, const char *prefix)
581
}
582
583
UNLEAK(real_git_dir);
584
+ UNLEAK(git_dir);
585
+ UNLEAK(work_tree);
586
587
flags |= INIT_DB_EXIST_OK;
588
return init_db(git_dir, real_git_dir, template_dir, flags);