do_one_ref(): save and restore value of current_ref
If do_one_ref() is called recursively, then the inner call should not permanently overwrite the value stored in current_ref by the outer call. Aside from the tiny optimization loss, peel_ref() expects the value of current_ref not to change across a call to peel_entry(). But in the presence of replace references that assumption could be violated by a recursive call to do_one_ref: do_for_each_entry() do_one_ref() builtin/describe.c:get_name() peel_ref() peel_entry() peel_object () deref_tag_noverify() parse_object() lookup_replace_object() do_lookup_replace_object() prepare_replace_object() do_for_each_ref() do_for_each_entry() do_for_each_entry_in_dir() do_one_ref() The inner call to do_one_ref() was unconditionally setting current_ref to NULL when it was done, causing peel_ref() to perform an invalid memory access. So change do_one_ref() to save the old value of current_ref before overwriting it, and restore the old value afterward rather than setting it to NULL. Reported-by: Mantas Mikulėnas <grawity@gmail.com> Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu> Signed-off-by: Junio C Hamano <gitster@pobox.com>
This commit is contained in:
parent
2f1ef15070
commit
d0cf51e940
6
refs.c
6
refs.c
@ -630,7 +630,9 @@ struct ref_entry_cb {
|
|||||||
static int do_one_ref(struct ref_entry *entry, void *cb_data)
|
static int do_one_ref(struct ref_entry *entry, void *cb_data)
|
||||||
{
|
{
|
||||||
struct ref_entry_cb *data = cb_data;
|
struct ref_entry_cb *data = cb_data;
|
||||||
|
struct ref_entry *old_current_ref;
|
||||||
int retval;
|
int retval;
|
||||||
|
|
||||||
if (prefixcmp(entry->name, data->base))
|
if (prefixcmp(entry->name, data->base))
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
@ -638,10 +640,12 @@ static int do_one_ref(struct ref_entry *entry, void *cb_data)
|
|||||||
!ref_resolves_to_object(entry))
|
!ref_resolves_to_object(entry))
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
/* Store the old value, in case this is a recursive call: */
|
||||||
|
old_current_ref = current_ref;
|
||||||
current_ref = entry;
|
current_ref = entry;
|
||||||
retval = data->fn(entry->name + data->trim, entry->u.value.sha1,
|
retval = data->fn(entry->name + data->trim, entry->u.value.sha1,
|
||||||
entry->flag, data->cb_data);
|
entry->flag, data->cb_data);
|
||||||
current_ref = NULL;
|
current_ref = old_current_ref;
|
||||||
return retval;
|
return retval;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user