• N
    Copy resolve_ref() return value for longer use · d5a35c11
    Nguyễn Thái Ngọc Duy 提交于
    resolve_ref() may return a pointer to a static buffer. Callers that
    use this value longer than a couple of statements should copy the
    value to avoid some hidden resolve_ref() call that may change the
    static buffer's value.
    
    The bug found by Tony Wang <wwwjfy@gmail.com> in builtin/merge.c
    demonstrates this. The first call is in cmd_merge()
    
    branch = resolve_ref("HEAD", head_sha1, 0, &flag);
    
    Then deep in lookup_commit_or_die() a few lines after, resolve_ref()
    may be called again and destroy "branch".
    
    lookup_commit_or_die
     lookup_commit_reference
      lookup_commit_reference_gently
       parse_object
        lookup_replace_object
         do_lookup_replace_object
          prepare_replace_object
           for_each_replace_ref
            do_for_each_ref
             get_loose_refs
              get_ref_dir
               get_ref_dir
                resolve_ref
    
    All call sites are checked and made sure that xstrdup() is called if
    the value should be saved.
    Signed-off-by: NNguyễn Thái Ngọc Duy <pclouds@gmail.com>
    Signed-off-by: NJunio C Hamano <gitster@pobox.com>
    d5a35c11
commit.c 43.1 KB