git_mailinfo_config() expects "struct mailinfo *". But in setup_mailinfo(), "mi" is already "struct mailinfo *". &mi would make it "struct mailinfo **" and git_mailinfo_config() would damage some other memory when it assigns some value to mi->use_scissors. This is caught by t4150.20. git_mailinfo_config() breaks mi->name.alloc and makes strbuf_release() in clear_mailinfo() attempt to free strbuf_slopbuf. Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@xxxxxxxxx> --- mailinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mailinfo.c b/mailinfo.c index e157ca6..f289941 100644 --- a/mailinfo.c +++ b/mailinfo.c @@ -1009,7 +1009,7 @@ void setup_mailinfo(struct mailinfo *mi) mi->header_stage = 1; mi->use_inbody_headers = 1; mi->content_top = mi->content; - git_config(git_mailinfo_config, &mi); + git_config(git_mailinfo_config, mi); } void clear_mailinfo(struct mailinfo *mi) -- 2.2.0.513.g477eb31 -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html