From fb04dced9c6510176f06953d2cd6a239703401f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Sat, 15 Jul 2017 19:18:51 +0200 Subject: tree-diff: don't access hash of NULL object_id pointer The object_id pointers can be NULL for invalid entries. Don't try to dereference them and pass NULL along to fill_tree_descriptor() instead, which handles them just fine. Found with Clang's UBSan. Signed-off-by: Rene Scharfe Signed-off-by: Junio C Hamano diff --git a/tree-diff.c b/tree-diff.c index 467e381..7f7ddda 100644 --- a/tree-diff.c +++ b/tree-diff.c @@ -422,8 +422,9 @@ static struct combine_diff_path *ll_diff_tree_paths( * diff_tree_oid(parent, commit) ) */ for (i = 0; i < nparent; ++i) - tptree[i] = fill_tree_descriptor(&tp[i], parents_oid[i]->hash); - ttree = fill_tree_descriptor(&t, oid->hash); + tptree[i] = fill_tree_descriptor(&tp[i], + parents_oid[i] ? parents_oid[i]->hash : NULL); + ttree = fill_tree_descriptor(&t, oid ? oid->hash : NULL); /* Enable recursion indefinitely */ opt->pathspec.recursive = DIFF_OPT_TST(opt, RECURSIVE); -- cgit v0.10.2-6-g49f6 From 3ea6b85a871aa41eaa66a2919451ad12d492c355 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Sat, 15 Jul 2017 20:15:26 +0200 Subject: notes: don't access hash of NULL object_id pointer Check if note is NULL, as we already do for different purposes a few lines above, and pass a NULL pointer to prepare_note_data() in that case instead of trying to access the hash member. Found with Clang's UBSan. Signed-off-by: Rene Scharfe Acked-by: Brandon Williams Signed-off-by: Junio C Hamano diff --git a/builtin/notes.c b/builtin/notes.c index 2ebc2b7..3d9dbc9 100644 --- a/builtin/notes.c +++ b/builtin/notes.c @@ -453,7 +453,7 @@ static int add(int argc, const char **argv, const char *prefix) oid_to_hex(&object)); } - prepare_note_data(&object, &d, note->hash); + prepare_note_data(&object, &d, note ? note->hash : NULL); if (d.buf.len || allow_empty) { write_note_data(&d, new_note.hash); if (add_note(t, &object, &new_note, combine_notes_overwrite)) -- cgit v0.10.2-6-g49f6 From f730944a49b2a210bb10520700c0a3f6c49bc020 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Sat, 15 Jul 2017 20:33:54 +0200 Subject: receive-pack: don't access hash of NULL object_id pointer We set old_oid to NULL if we found out that it's a corrupt reference. In that case don't try to access the hash member and pass NULL to ref_transaction_delete() instead. Found with Clang's UBSan. Signed-off-by: Rene Scharfe Signed-off-by: Junio C Hamano diff --git a/builtin/receive-pack.c b/builtin/receive-pack.c index b1706a5..f589e8a 100644 --- a/builtin/receive-pack.c +++ b/builtin/receive-pack.c @@ -1137,7 +1137,7 @@ static const char *update(struct command *cmd, struct shallow_info *si) } if (ref_transaction_delete(transaction, namespaced_name, - old_oid->hash, + old_oid ? old_oid->hash : NULL, 0, "push", &err)) { rp_error("%s", err.buf); strbuf_release(&err); -- cgit v0.10.2-6-g49f6