kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

dir: free allocations on parse-error paths in read_one_dir() 

When read_one_dir() encounters a parse error while reading the
untracked cache from disk, it returns -1 immediately. Two
allocations made earlier in the function can leak on these
early-return paths: ud.untracked (allocated at line 3846 when
untracked_nr > 0) and ud.dirs (allocated at line 3851).

Free both before returning on the two error paths between these
allocations and the point where they are transferred into the
final xmalloc'd struct at line 3857.

Pointed out by Coverity.

Assisted-by: Claude Opus 4.6
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Johannes Schindelin 2026-07-01 07:04:25 +00:00 committed by Junio C Hamano
parent 1037b3c615
commit 5f729580a0
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
dir.c
View File

@ -3792,13 +3792,18 @@ static int read_one_dir(struct untracked_cache_dir **untracked_,
ALLOC_ARRAY(ud.untracked, ud.untracked_nr);

ud.dirs_alloc = ud.dirs_nr = decode_varint(&data);
if (data > end)
if (data > end) {
free(ud.untracked);
return -1;
}
ALLOC_ARRAY(ud.dirs, ud.dirs_nr);

eos = memchr(data, '\0', end - data);
if (!eos || eos == end)
if (!eos || eos == end) {
free(ud.untracked);
free(ud.dirs);
return -1;
}

*untracked_ = untracked = xmalloc(st_add3(sizeof(*untracked), eos - data, 1));
memcpy(untracked, &ud, sizeof(ud));