| Message ID | 20181025235314.63495-1-matvore@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] list-objects.c: don't segfault for missing cmdline objects | expand |
Matthew DeVore <matvore@google.com> writes: > When a command is invoked with both --exclude-promisor-objects, > --objects-edge-aggressive, and a missing object on the command line, > the rev_info.cmdline array could get a NULL pointer for the value of > an 'item' field. Prevent dereferencing of a NULL pointer in that > situation. Thanks. > There are a few other places in the code where rev_info.cmdline is read > and the code doesn't handle NULL objects, but I couldn't prove to myself > that any of them needed to change except this one (since it may not > actually be possible to reach the other code paths with > rev_info.cmdline[] set to NULL). > > Signed-off-by: Matthew DeVore <matvore@google.com> > --- > list-objects.c | 3 ++- > t/t0410-partial-clone.sh | 6 +++++- > 2 files changed, 7 insertions(+), 2 deletions(-) > > diff --git a/list-objects.c b/list-objects.c > index c41cc80db5..27ed2c6cab 100644 > --- a/list-objects.c > +++ b/list-objects.c > @@ -245,7 +245,8 @@ void mark_edges_uninteresting(struct rev_info *revs, show_edge_fn show_edge) > for (i = 0; i < revs->cmdline.nr; i++) { > struct object *obj = revs->cmdline.rev[i].item; > struct commit *commit = (struct commit *)obj; > - if (obj->type != OBJ_COMMIT || !(obj->flags & UNINTERESTING)) > + if (!obj || obj->type != OBJ_COMMIT || > + !(obj->flags & UNINTERESTING)) > continue; > mark_tree_uninteresting(revs->repo, > get_commit_tree(commit)); > diff --git a/t/t0410-partial-clone.sh b/t/t0410-partial-clone.sh > index ba3887f178..e52291e674 100755 > --- a/t/t0410-partial-clone.sh > +++ b/t/t0410-partial-clone.sh > @@ -366,7 +366,11 @@ test_expect_success 'rev-list accepts missing and promised objects on command li > > git -C repo config core.repositoryformatversion 1 && > git -C repo config extensions.partialclone "arbitrary string" && > - git -C repo rev-list --exclude-promisor-objects --objects "$COMMIT" "$TREE" "$BLOB" > + > + git -C repo rev-list --objects \ > + --exclude-promisor-objects "$COMMIT" "$TREE" "$BLOB" && > + git -C repo rev-list --objects-edge-aggressive \ > + --exclude-promisor-objects "$COMMIT" "$TREE" "$BLOB" > ' > > test_expect_success 'gc repacks promisor objects separately from non-promisor objects' '
diff --git a/list-objects.c b/list-objects.c index c41cc80db5..27ed2c6cab 100644 --- a/list-objects.c +++ b/list-objects.c @@ -245,7 +245,8 @@ void mark_edges_uninteresting(struct rev_info *revs, show_edge_fn show_edge) for (i = 0; i < revs->cmdline.nr; i++) { struct object *obj = revs->cmdline.rev[i].item; struct commit *commit = (struct commit *)obj; - if (obj->type != OBJ_COMMIT || !(obj->flags & UNINTERESTING)) + if (!obj || obj->type != OBJ_COMMIT || + !(obj->flags & UNINTERESTING)) continue; mark_tree_uninteresting(revs->repo, get_commit_tree(commit)); diff --git a/t/t0410-partial-clone.sh b/t/t0410-partial-clone.sh index ba3887f178..e52291e674 100755 --- a/t/t0410-partial-clone.sh +++ b/t/t0410-partial-clone.sh @@ -366,7 +366,11 @@ test_expect_success 'rev-list accepts missing and promised objects on command li git -C repo config core.repositoryformatversion 1 && git -C repo config extensions.partialclone "arbitrary string" && - git -C repo rev-list --exclude-promisor-objects --objects "$COMMIT" "$TREE" "$BLOB" + + git -C repo rev-list --objects \ + --exclude-promisor-objects "$COMMIT" "$TREE" "$BLOB" && + git -C repo rev-list --objects-edge-aggressive \ + --exclude-promisor-objects "$COMMIT" "$TREE" "$BLOB" ' test_expect_success 'gc repacks promisor objects separately from non-promisor objects' '
When a command is invoked with both --exclude-promisor-objects, --objects-edge-aggressive, and a missing object on the command line, the rev_info.cmdline array could get a NULL pointer for the value of an 'item' field. Prevent dereferencing of a NULL pointer in that situation. There are a few other places in the code where rev_info.cmdline is read and the code doesn't handle NULL objects, but I couldn't prove to myself that any of them needed to change except this one (since it may not actually be possible to reach the other code paths with rev_info.cmdline[] set to NULL). Signed-off-by: Matthew DeVore <matvore@google.com> --- list-objects.c | 3 ++- t/t0410-partial-clone.sh | 6 +++++- 2 files changed, 7 insertions(+), 2 deletions(-)