In some instances, match_refs() was setting the peer_ref field in the
dst ref list such that it pointed to a ref in the src list, instead of
to a copy. This would cause a double-free when both the src and dst ref
lists were freed, as free_refs() frees the peer_ref. A double-free would
also occur if the same branch was pushed to two different destinations
such as:
push = refs/heads/master:refs/heads/backup
push = refs/heads/master:refs/heads/master
This patch corrects the problem by copying the ref when it has been
plucked from the src list.
Signed-off-by: Jay Soffian <jaysoffian@xxxxxxxxx>
---
remote.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/remote.c b/remote.c
index 5cb443f..ab387f2 100644
--- a/remote.c
+++ b/remote.c
@@ -930,6 +930,7 @@ static int match_explicit(struct ref *src, struct ref *dst,
struct refspec *rs)
{
struct ref *matched_src, *matched_dst;
+ int copy_src;
const char *dst_value = rs->dst;
char *dst_guess;
@@ -940,6 +941,7 @@ static int match_explicit(struct ref *src, struct ref *dst,
matched_src = matched_dst = NULL;
switch (count_refspec_match(rs->src, src, &matched_src)) {
case 1:
+ copy_src = 1;
break;
case 0:
/* The source could be in the get_sha1() format
@@ -949,6 +951,7 @@ static int match_explicit(struct ref *src, struct ref *dst,
matched_src = try_explicit_object_name(rs->src);
if (!matched_src)
return error("src refspec %s does not match any.", rs->src);
+ copy_src = 0;
break;
default:
return error("src refspec %s matches more than one.", rs->src);
@@ -994,7 +997,7 @@ static int match_explicit(struct ref *src, struct ref *dst,
return error("dst ref %s receives from more than one src.",
matched_dst->name);
else {
- matched_dst->peer_ref = matched_src;
+ matched_dst->peer_ref = copy_src ? copy_ref(matched_src) : matched_src;
matched_dst->force = rs->force;
}
return 0;
@@ -1102,7 +1105,7 @@ int match_refs(struct ref *src, struct ref *dst, struct ref ***dst_tail,
dst_peer = make_linked_ref(dst_name, dst_tail);
hashcpy(dst_peer->new_sha1, src->new_sha1);
}
- dst_peer->peer_ref = src;
+ dst_peer->peer_ref = copy_ref(src);
dst_peer->force = pat->force;
free_name:
free(dst_name);
--
1.6.2.rc1.223.gfed32
--
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
