When we write an alternate shallow file in update_shallow, we write it
into the lock file. The string stored in alternate_shallow_file is
copied from the lock file path, but it is freed the moment that the lock
file is closed, since we call strbuf_release to free that path.

This used to work, since we did not invoke git index-pack more than
once. However, we now do, and starting with bd0b42aed3 (fetch-pack: do
not take shallow lock unnecessarily - 2019-01-10), we no longer reset
this value unconditionally; consequently, we reuse the freed memory.
Ensure we reset the value to NULL to avoid using freed memory. git
index-pack will read the repository's shallow file, which will have been
updated with the correct information.

Signed-off-by: brian m. carlson <sand...@crustytoothpaste.net>
---
 fetch-pack.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fetch-pack.c b/fetch-pack.c
index 577faa6229..a92621a388 100644
--- a/fetch-pack.c
+++ b/fetch-pack.c
@@ -1272,6 +1272,8 @@ static void receive_shallow_info(struct fetch_pack_args 
*args,
                setup_alternate_shallow(&shallow_lock, &alternate_shallow_file,
                                        NULL);
                args->deepen = 1;
+       } else {
+               alternate_shallow_file = NULL;
        }
 }
 
@@ -1489,6 +1491,7 @@ static void update_shallow(struct fetch_pack_args *args,
                        rollback_lock_file(&shallow_lock);
                } else
                        commit_lock_file(&shallow_lock);
+               alternate_shallow_file = NULL;
                return;
        }
 
@@ -1512,6 +1515,7 @@ static void update_shallow(struct fetch_pack_args *args,
                                                &alternate_shallow_file,
                                                &extra);
                        commit_lock_file(&shallow_lock);
+                       alternate_shallow_file = NULL;
                }
                oid_array_clear(&extra);
                return;
@@ -1551,6 +1555,7 @@ static void update_shallow(struct fetch_pack_args *args,
                commit_lock_file(&shallow_lock);
                oid_array_clear(&extra);
                oid_array_clear(&ref);
+               alternate_shallow_file = NULL;
                return;
        }
 

Reply via email to