From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS3215 2.6.0.0/16 X-Spam-Status: No, score=-3.8 required=3.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE, URIBL_CSS,URIBL_CSS_A shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from out1.vger.email (out1.vger.email [IPv6:2620:137:e000::1:20]) by dcvr.yhbt.net (Postfix) with ESMTP id 69CE71F4D7 for ; Fri, 3 Jun 2022 21:28:17 +0000 (UTC) Authentication-Results: dcvr.yhbt.net; dkim=pass (1024-bit key; unprotected) header.d=pobox.com header.i=@pobox.com header.b="iGPB537T"; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346925AbiFCV2O (ORCPT ); Fri, 3 Jun 2022 17:28:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45492 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1346958AbiFCV2N (ORCPT ); Fri, 3 Jun 2022 17:28:13 -0400 Received: from pb-smtp21.pobox.com (pb-smtp21.pobox.com [173.228.157.53]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA6A238BDF for ; Fri, 3 Jun 2022 14:28:11 -0700 (PDT) Received: from pb-smtp21.pobox.com (unknown [127.0.0.1]) by pb-smtp21.pobox.com (Postfix) with ESMTP id 30CC819A3BD; Fri, 3 Jun 2022 17:28:11 -0400 (EDT) (envelope-from junio@pobox.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed; d=pobox.com; h=from:to:cc :subject:references:date:in-reply-to:message-id:mime-version :content-type:content-transfer-encoding; s=sasl; bh=cZxBC5VcEKq5 ad3CsoIXZTbkzLzD8o0bq2tToem18Ps=; b=iGPB537TLzU+krnETrgGKcMYZUs3 kwWAVez/zJMcgKzlxin4twLfNC9P6cmnCHCALUfblFjiIvcQHnk/eYudZ0+n/paY 2rqr0StlNSAe9MBRdbGqXFw25SOIrQID/daEaiUnMkhWQGLctyD45EXHkzfMQjXY 455c42EmKApFNKU= Received: from pb-smtp21.sea.icgroup.com (unknown [127.0.0.1]) by pb-smtp21.pobox.com (Postfix) with ESMTP id 29F0819A3BC; Fri, 3 Jun 2022 17:28:11 -0400 (EDT) (envelope-from junio@pobox.com) Received: from pobox.com (unknown [34.83.92.57]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pb-smtp21.pobox.com (Postfix) with ESMTPSA id C956919A3BB; Fri, 3 Jun 2022 17:28:07 -0400 (EDT) (envelope-from junio@pobox.com) From: Junio C Hamano To: =?utf-8?Q?Ren=C3=A9?= Scharfe Cc: =?utf-8?B?w4Z2YXIgQXJuZmrDtnLDsA==?= Bjarmason , git@vger.kernel.org, Jinoh Kang , Phillip Wood , Glen Choo , Paul Tan , Han-Wen Nienhuys , Karthik Nayak , Jeff Smith , Taylor Blau Subject: Re: [RFC PATCH 01/15] remote.c: don't dereference NULL in freeing loop References: <0c296c0e-bbd4-57a6-1cab-3b98c3bc8927@web.de> Date: Fri, 03 Jun 2022 14:28:06 -0700 In-Reply-To: <0c296c0e-bbd4-57a6-1cab-3b98c3bc8927@web.de> (=?utf-8?Q?=22R?= =?utf-8?Q?en=C3=A9?= Scharfe"'s message of "Fri, 3 Jun 2022 23:07:52 +0200") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 X-Pobox-Relay-ID: 0F9774CA-E384-11EC-B312-CBA7845BAAA9-77302942!pb-smtp21.pobox.com Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org Ren=C3=A9 Scharfe writes: >> - for (i =3D 0; i < remote->pushurl_nr; i++) { >> + for (i =3D 0; i < remote->pushurl_nr; i++) >> free((char *)remote->pushurl[i]); >> - } >> FREE_AND_NULL(remote->pushurl); > > Why set pushurl to NULL after release? This results in an invalid stat= e > unless pushurl_nr und pushurl_alloc are reset to zero. Same goes for > the url array above -- either a simple free(3) call suffices or url_nr > and url_alloc need to be cleared as well. We probably should give a huge warning next to FREE_AND_NULL() about this. It also is an effective way to hide an existing bug under the rug. diff_options.pathspec might be freed prematurely which may be noticed by a use-after-free if left to use free(), but FREE_AND_NULL() will mislead the use-after-free caller into thinkig that "ah there is no pathspec to be used" and produce nonsense result without crashing. Thanks.