kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

Merge branch 'sk/object-name-use-after-free' into next 

A heap-use-after-free bug in the object name parsing code when
reporting failures with a relative path to a sparse directory has
been corrected.

* sk/object-name-use-after-free:
  object-name: avoid use-after-free in get_oid_with_context_1()
next
Junio C Hamano 2026-08-20 07:32:01 -07:00
parent b9c47eddd0 0bb83c5f47
commit b0804dff5f
2 changed files with 19 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
object-name.c
View File

@ -1803,13 +1803,15 @@ static enum get_oid_result get_oid_with_context_1(struct repository *repo,
memcmp(ce->name, cp, namelen))
break;
if (ce_stage(ce) == stage) {
int ret = reject_tree_in_index(repo, only_to_die, ce,
stage, prefix, cp);

if (!ret) {
oidcpy(oid, &ce->oid);
oc->mode = ce->ce_mode;
}
free(new_path);
if (reject_tree_in_index(repo, only_to_die, ce,
stage, prefix, cp))
return -1;
oidcpy(oid, &ce->oid);
oc->mode = ce->ce_mode;
return 0;
return ret;
}
pos++;
}

11
t/t1092-sparse-checkout-compatibility.sh
View File

@ -1405,6 +1405,17 @@ do
"
done

test_expect_success 'relative path to a sparse directory' '
init_repos &&

# A ":<stage>:<path>" argument whose path is relative is resolved
# into a heap-allocated buffer, and a sparse directory found at that
# path is reported through it. Cover that combination, so that the
# reporting does not read the buffer after it has been released.
test_sparse_match test_must_fail git show :0:./folder1/ &&
test_sparse_match test_must_fail git rev-parse :0:./folder1/
'

test_expect_success 'submodule handling' '
init_repos &&