diff options
author | Jeff King <peff@peff.net> | 2019-08-25 10:19:51 +0300 |
---|---|---|
committer | Junio C Hamano <gitster@pobox.com> | 2019-08-26 20:29:56 +0300 |
commit | 60fe477a0be2a3801e5ce3913e0be8e8e2e58e4f (patch) | |
tree | 3233bf20b5adeb58359de561a7a57b3432bfe146 /notes.c | |
parent | 779ad6641b9a6443eaec75439b3374b1a7b8794c (diff) |
notes: avoid potential use-after-free during insertion
The note_tree_insert() function may free the leaf_node struct we pass in
(e.g., if it's a duplicate, or if it needs to be combined with an
existing note).
Most callers are happy with this, as they assume that ownership of the
struct is handed off. But in load_subtree(), if we see an error we'll
use the handed-off struct's key_oid to generate the die() message,
potentially accessing freed memory.
We can easily fix this by instead using the original oid that we copied
into the leaf_node struct.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'notes.c')
-rw-r--r-- | notes.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -460,7 +460,7 @@ static void load_subtree(struct notes_tree *t, struct leaf_node *subtree, die("Failed to load %s %s into notes tree " "from %s", type == PTR_TYPE_NOTE ? "note" : "subtree", - oid_to_hex(&l->key_oid), t->ref); + oid_to_hex(&object_oid), t->ref); continue; |