git-commit-vandalism/builtin
Nguyễn Thái Ngọc Duy d5a35c114a Copy resolve_ref() return value for longer use
resolve_ref() may return a pointer to a static buffer. Callers that
use this value longer than a couple of statements should copy the
value to avoid some hidden resolve_ref() call that may change the
static buffer's value.

The bug found by Tony Wang <wwwjfy@gmail.com> in builtin/merge.c
demonstrates this. The first call is in cmd_merge()

branch = resolve_ref("HEAD", head_sha1, 0, &flag);

Then deep in lookup_commit_or_die() a few lines after, resolve_ref()
may be called again and destroy "branch".

lookup_commit_or_die
 lookup_commit_reference
  lookup_commit_reference_gently
   parse_object
    lookup_replace_object
     do_lookup_replace_object
      prepare_replace_object
       for_each_replace_ref
        do_for_each_ref
         get_loose_refs
          get_ref_dir
           get_ref_dir
            resolve_ref

All call sites are checked and made sure that xstrdup() is called if
the value should be saved.

Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2011-12-05 16:21:06 -08:00
..
add.c Merge branch 'ci/commit--interactive-atomic' 2011-05-16 16:47:10 -07:00
annotate.c
apply.c Merge branch 'jc/apply-blank-at-eof-fix' into maint 2011-10-21 10:49:26 -07:00
archive.c upload-archive: use start_command instead of fork 2011-10-30 18:45:21 -07:00
bisect--helper.c
blame.c Merge branch 'ss/blame-textconv-fake-working-tree' 2011-11-07 16:43:19 -08:00
branch.c Copy resolve_ref() return value for longer use 2011-12-05 16:21:06 -08:00
bundle.c Teach progress eye-candy to fetch_refs_from_bundle() 2011-09-19 11:07:21 -07:00
cat-file.c
check-attr.c Merge branch 'bc/attr-ignore-case' 2011-10-17 21:37:14 -07:00
check-ref-format.c Change check_refname_format() to reject unnormalized refnames 2011-10-05 13:45:30 -07:00
checkout-index.c
checkout.c Copy resolve_ref() return value for longer use 2011-12-05 16:21:06 -08:00
clean.c
clone.c clone: Quote user supplied path in a single quote pair 2011-10-27 12:02:02 -07:00
commit-tree.c
commit.c Copy resolve_ref() return value for longer use 2011-12-05 16:21:06 -08:00
config.c Merge branch 'mm/maint-config-explicit-bool-display' into maint 2011-10-21 10:49:24 -07:00
count-objects.c
describe.c describe: Refresh the index when run with --dirty 2011-09-23 14:28:17 -07:00
diff-files.c
diff-index.c
diff-tree.c
diff.c
fast-export.c
fetch-pack.c Merge branch 'mh/check-ref-format-3' 2011-10-10 15:56:18 -07:00
fetch.c Merge branch 'cn/fetch-prune' 2011-10-26 16:16:29 -07:00
fmt-merge-msg.c Copy resolve_ref() return value for longer use 2011-12-05 16:21:06 -08:00
for-each-ref.c
fsck.c
gc.c
grep.c builtin/grep: simplify lock_and_read_sha1_file() 2011-10-26 13:09:23 -07:00
hash-object.c
help.c
index-pack.c Merge branch 'jc/index-pack' 2011-07-19 09:54:51 -07:00
init-db.c
log.c format-patch: ignore ui.color 2011-09-12 11:43:58 -07:00
ls-files.c Merge branch 'cb/common-prefix-unification' 2011-10-10 15:56:17 -07:00
ls-remote.c Merge branch 'jc/ls-remote-short-help' 2011-10-05 12:36:26 -07:00
ls-tree.c
mailinfo.c mailinfo: always clean up rfc822 header folding 2011-05-26 14:13:38 -07:00
mailsplit.c
merge-base.c
merge-file.c
merge-index.c
merge-ours.c
merge-recursive.c
merge-tree.c
merge.c Copy resolve_ref() return value for longer use 2011-12-05 16:21:06 -08:00
mktag.c
mktree.c Merge "Move 'builtin-*' into a 'builtin/' subdirectory" 2011-11-10 09:10:51 -08:00
mv.c builtin/mv.c: plug miniscule memory leak 2011-10-06 13:54:32 -07:00
name-rev.c name-rev: split usage string 2011-10-03 11:55:57 -07:00
notes.c Copy resolve_ref() return value for longer use 2011-12-05 16:21:06 -08:00
pack-objects.c Merge branch 'dm/pack-objects-update' 2011-11-01 15:20:07 -07:00
pack-redundant.c
pack-refs.c
patch-id.c patch-id.c: use strbuf instead of a fixed buffer 2011-09-22 09:35:07 -07:00
prune-packed.c
prune.c
push.c
read-tree.c
receive-pack.c Copy resolve_ref() return value for longer use 2011-12-05 16:21:06 -08:00
reflog.c
remote-ext.c
remote-fd.c
remote.c Convert many resolve_ref() calls to read_ref*() and ref_exists() 2011-11-13 12:21:06 -08:00
replace.c Convert many resolve_ref() calls to read_ref*() and ref_exists() 2011-11-13 12:21:06 -08:00
rerere.c
reset.c Merge branch 'jk/reset-reflog-message-fix' into maint 2011-09-11 22:33:20 -07:00
rev-list.c
rev-parse.c
revert.c Merge branch 'js/no-cherry-pick-head-after-punted' 2011-10-19 10:49:05 -07:00
rm.c
send-pack.c rename "match_refs()" to "match_push_refs()" 2011-09-12 16:41:53 -07:00
shortlog.c
show-branch.c
show-ref.c Convert many resolve_ref() calls to read_ref*() and ref_exists() 2011-11-13 12:21:06 -08:00
stripspace.c
symbolic-ref.c
tag.c Convert many resolve_ref() calls to read_ref*() and ref_exists() 2011-11-13 12:21:06 -08:00
tar-tree.c
unpack-file.c
unpack-objects.c
update-index.c
update-ref.c
update-server-info.c
upload-archive.c upload-archive: use start_command instead of fork 2011-10-30 18:45:21 -07:00
var.c
verify-pack.c
verify-tag.c
write-tree.c