From patchwork Mon Aug 17 21:33:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff King X-Patchwork-Id: 11719231 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 67764618 for ; Mon, 17 Aug 2020 21:33:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5830920758 for ; Mon, 17 Aug 2020 21:33:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728449AbgHQVdP (ORCPT ); Mon, 17 Aug 2020 17:33:15 -0400 Received: from cloud.peff.net ([104.130.231.41]:33564 "EHLO cloud.peff.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728432AbgHQVdI (ORCPT ); Mon, 17 Aug 2020 17:33:08 -0400 Received: (qmail 6697 invoked by uid 109); 17 Aug 2020 21:33:07 -0000 Received: from Unknown (HELO peff.net) (10.0.1.2) by cloud.peff.net (qpsmtpd/0.94) with ESMTP; Mon, 17 Aug 2020 21:33:07 +0000 Authentication-Results: cloud.peff.net; auth=none Received: (qmail 22268 invoked by uid 111); 17 Aug 2020 21:33:06 -0000 Received: from coredump.intra.peff.net (HELO sigill.intra.peff.net) (10.0.0.2) by peff.net (qpsmtpd/0.94) with (TLS_AES_256_GCM_SHA384 encrypted) ESMTPS; Mon, 17 Aug 2020 17:33:06 -0400 Authentication-Results: peff.net; auth=none Date: Mon, 17 Aug 2020 17:33:06 -0400 From: Jeff King To: git@vger.kernel.org Cc: Junio C Hamano , Eric Sunshine Subject: [PATCH v2 3/7] checkout: fix leak of non-existent branch names Message-ID: <20200817213306.GC1854722@coredump.intra.peff.net> References: <20200817213228.GA1854603@coredump.intra.peff.net> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20200817213228.GA1854603@coredump.intra.peff.net> Sender: git-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org We unconditionally write a branch name into a newly allocated buffer in new_branch_info->path, via setup_branch_path(). We then check to see if the branch exists; if not, we set that field to NULL, leaking the memory. We should take care to free() it when doing so. Signed-off-by: Jeff King --- builtin/checkout.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/builtin/checkout.c b/builtin/checkout.c index 2837195491..bba64108af 100644 --- a/builtin/checkout.c +++ b/builtin/checkout.c @@ -1120,8 +1120,10 @@ static void setup_new_branch_info_and_source_tree( if (!check_refname_format(new_branch_info->path, 0) && !read_ref(new_branch_info->path, &branch_rev)) oidcpy(rev, &branch_rev); - else + else { + free((char *)new_branch_info->path); new_branch_info->path = NULL; /* not an existing branch */ + } new_branch_info->commit = lookup_commit_reference_gently(the_repository, rev, 1); if (!new_branch_info->commit) {