Re: [PATCH v2] merge: fix cache_entry use-after-free

2015-10-14 Thread David Turner
On Wed, 2015-10-14 at 14:17 -0700, Junio C Hamano wrote: > David Turner writes: > > > + unsigned int ref_count; /* count the number of refs to this in dir_hash > > */ > > Me makes a mental note of the type used... > > > @@ -213,6 +214,32 @@ struct cache_entry { > > struct pathspec; > > >

Re: [PATCH v2] merge: fix cache_entry use-after-free

2015-10-14 Thread Junio C Hamano
David Turner writes: > + unsigned int ref_count; /* count the number of refs to this in dir_hash > */ Me makes a mental note of the type used... > @@ -213,6 +214,32 @@ struct cache_entry { > struct pathspec; > > /* > + * Increment the cache_entry reference count. Should be called > +

Re: [PATCH v2] merge: fix cache_entry use-after-free

2015-10-13 Thread Junio C Hamano
David Turner writes: >> This one smelled iffy. I think it is safe because the caller does >> not look at src[] other than src[0] after this function returns, and >> this setting to NULL happens only when o->merge is set to 1, so I do >> not think this is buggy, but at the same time I do not thin

Re: [PATCH v2] merge: fix cache_entry use-after-free

2015-10-13 Thread David Turner
On Mon, 2015-10-12 at 15:28 -0700, Junio C Hamano wrote: > David Turner writes: > > > From: Keith McGuigan > > > > During merges, we would previously free entries that we no longer need > > in the destination index. But those entries might also be stored in > > the dir_entry cache, and when a l

Re: [PATCH v2] merge: fix cache_entry use-after-free

2015-10-12 Thread Junio C Hamano
David Turner writes: > From: Keith McGuigan > > During merges, we would previously free entries that we no longer need > in the destination index. But those entries might also be stored in > the dir_entry cache, and when a later call to add_to_index found them, > they would be used after being

[PATCH v2] merge: fix cache_entry use-after-free

2015-10-12 Thread David Turner
From: Keith McGuigan During merges, we would previously free entries that we no longer need in the destination index. But those entries might also be stored in the dir_entry cache, and when a later call to add_to_index found them, they would be used after being freed. To prevent this, add a ref