kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

send-pack: fix leaking push cert nonce 

When retrieving the push cert nonce from the server, we first store the
constant returned by `server_feature_value()` and then, if the nonce is
valid, we duplicate the nonce memory to a NUL-terminated string, so that
we can pass it to `generate_push_cert()`. We never free the latter and
thus cause a memory leak.

Fix this by storing the limited-lifetime nonce into a scope-local
variable such that the long-lived, allocated nonce can be easily freed
without having to cast away its constness.

This leak was exposed by t5534, but fixing it is not sufficient to make
the whole test suite leak free.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
maint
Patrick Steinhardt 2024-09-05 12:09:04 +02:00 committed by Junio C Hamano
parent 42c153e1c0
commit 49d47eb541
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
send-pack.c
View File

@ -501,7 +501,7 @@ int send_pack(struct send_pack_args *args,
unsigned cmds_sent = 0;
int ret;
struct async demux;
const char *push_cert_nonce = NULL;
char *push_cert_nonce = NULL;
struct packet_reader reader;
int use_bitmaps;

@ -550,10 +550,11 @@ int send_pack(struct send_pack_args *args,

if (args->push_cert != SEND_PACK_PUSH_CERT_NEVER) {
size_t len;
push_cert_nonce = server_feature_value("push-cert", &len);
if (push_cert_nonce) {
reject_invalid_nonce(push_cert_nonce, len);
push_cert_nonce = xmemdupz(push_cert_nonce, len);
const char *nonce = server_feature_value("push-cert", &len);

if (nonce) {
reject_invalid_nonce(nonce, len);
push_cert_nonce = xmemdupz(nonce, len);
} else if (args->push_cert == SEND_PACK_PUSH_CERT_ALWAYS) {
die(_("the receiving end does not support --signed push"));
} else if (args->push_cert == SEND_PACK_PUSH_CERT_IF_ASKED) {
@ -771,5 +772,6 @@ out:
oid_array_clear(&commons);
strbuf_release(&req_buf);
strbuf_release(&cap_buf);
free(push_cert_nonce);
return ret;
}