[0/3] double-free with git fetch --prefetch

Message

Jeff King Nov. 12, 2024, 8:32 a.m. UTC

On Tue, Nov 12, 2024 at 01:49:51AM -0500, Jeff King wrote:

> Bisecting on:
> 
>   make SANITIZE=address &&
>   bin-wrappers/git fetch --prefetch origin master
> 
> turns up my ea4780307c (fetch: free "raw" string when shrinking refspec,
> 2024-09-24). I'll see if I can figure out what's going on.

OK, it turns out to be a fairly simple bug. The hardest part was
figuring out why it was not triggering all the time already in the test
suite. ;)

Patch 1 is the minimal fix. It is sort-of a regression in v2.47, in that
it became easier to trigger the bug; but it existed before then. Either
way, it seems like material for the "maint" branch.

The other two patches are cleanups that I contemplated when doing
ea4780307c. Now that this code has caused _two_ bugs which would have
been impossible with the cleanups, I figured it was worth taking a stab
at it.

Thanks for a clear report.

  [1/3]: fetch: adjust refspec->raw_nr when filtering prefetch refspecs
  [2/3]: refspec: drop separate raw_nr count
  [3/3]: refspec: store raw refspecs inside refspec_item

 builtin/fetch.c                   |  8 ++------
 builtin/remote.c                  | 16 ++++++++--------
 refspec.c                         | 26 ++++++++++----------------
 refspec.h                         |  6 ++----
 submodule.c                       |  8 ++++----
 t/t5582-fetch-negative-refspec.sh |  4 ++++
 6 files changed, 30 insertions(+), 38 deletions(-)

-Peff