refs: fix segfault when aborting empty transaction
When cleaning up a transaction that has no updates queued, then the transaction's backend data will not have been allocated. We correctly handle this for the packed backend, where the cleanup function checks whether the backend data has been allocated at all -- if not, then there is nothing to clean up. For the files backend we do not check this and as a result will hit a segfault due to dereferencing a `NULL` pointer when cleaning up such a transaction. Fix the issue by checking whether `backend_data` is set in the files backend, too. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Patrick Steinhardt committed
Mar 30, 2020 at 15:46 UTC
edc30691e5729435177e4fdccb8c13c3948e3c5a
1 file changed
+10
-8
refs/files-backend.c
+10
-8
@@ -2565,16 +2565,18 @@ static void files_transaction_cleanup(struct files_ref_store *refs,
2565
}
2566
}
2567
2568
- if (backend_data->packed_transaction &&
2569
- ref_transaction_abort(backend_data->packed_transaction, &err)) {
2570
- error("error aborting transaction: %s", err.buf);
2571
- strbuf_release(&err);
2572
- }
2568
+ if (backend_data) {
2569
+ if (backend_data->packed_transaction &&
2570
+ ref_transaction_abort(backend_data->packed_transaction, &err)) {
2571
+ error("error aborting transaction: %s", err.buf);
2572
+ strbuf_release(&err);
2573
+ }
2574
2574
- if (backend_data->packed_refs_locked)
2575
- packed_refs_unlock(refs->packed_ref_store);
2575
+ if (backend_data->packed_refs_locked)
2576
+ packed_refs_unlock(refs->packed_ref_store);
2577
2577
- free(backend_data);
2578
+ free(backend_data);
2579
+ }
2580
2581
transaction->state = REF_TRANSACTION_CLOSED;
2582
}