As Peff reported [1], the refactored can_all_from_reach_with_flags() method does not properly peel tags. Since the helper method can_all_from_reach() and code in t/helper/test-reach.c all peel tags before getting to this method, it is not super-simple to create a test that demonstrates this. I modified t/helper/test-reach.c to allow calling can_all_from_reach_with_flags() directly, and added a test in t6600-test-reach.sh that demonstrates the segfault without the fix. For V2, I compared the loop that inspects the 'from' commits in commit ba3ca1edce "commit-reach: move can_all_from_reach_with_flags" to the version here and got the following diff: 3c3 < if (from_one->flags & assign_flag) --- > if (!from_one || from_one->flags & assign_flag) 5c5,7 < from_one = deref_tag(the_repository, from_one, "a from object", 0); --- > > from_one = deref_tag(the_repository, from_one, > "a from object", 0); 14a17,22 > > list[nr_commits] = (struct commit *)from_one; > if (parse_commit(list[nr_commits]) || > list[nr_commits]->generation < min_generation) > return 0; /* is this a leak? */ > nr_commits++; This diff includes the early termination we had before 'deref_tag' and the comment for why we can ignore non-commit objects. [1] https://public-inbox.org/git/0bf9103c-9377-506b-7ad7-e5273d8e94fc@xxxxxxxxx/T/#u Derrick Stolee (2): commit-reach: properly peel tags commit-reach: fix memory and flag leaks commit-reach.c | 41 ++++++++++++++++++++++++++++++++++------- t/helper/test-reach.c | 22 +++++++++++++++++----- t/t6600-test-reach.sh | 30 ++++++++++++++++++++++++++++-- 3 files changed, 79 insertions(+), 14 deletions(-) base-commit: 6621c838743812aaba96e55cfec8524ea1144c2d Published-As: https://github.com/gitgitgadget/git/releases/tags/pr-39%2Fderrickstolee%2Ftag-fix-v3 Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-39/derrickstolee/tag-fix-v3 Pull-Request: https://github.com/gitgitgadget/git/pull/39 Range-diff vs v2: 1: 4bf21204dd ! 1: 0a1e661271 commit-reach: properly peel tags @@ -53,8 +53,11 @@ + + list[nr_commits] = (struct commit *)from_one; + if (parse_commit(list[nr_commits]) || -+ list[nr_commits]->generation < min_generation) -+ return 0; /* is this a leak? */ ++ list[nr_commits]->generation < min_generation) { ++ result = 0; ++ goto cleanup; ++ } ++ + nr_commits++; } -: ---------- > 2: b2e0ee4978 commit-reach: fix memory and flag leaks -- gitgitgadget
