[PATCH 0/2] Sequencer: avoid use-after-free when creating merges

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This series fixes a use-after-free bug reported in [1]. The bug is caused by
storing a pointer to the buffer in a static strbuf that gets reallocated.
There was some discussion about removing the buffer and making the caller
responsible for freeing the returned string. In the end I decided to keep
the buffer as it avoids having to remember to free the return value and
instead stop storing the pointer to it in a long-lived variable.

Many thanks to Kristoffer for the detailed bug report and backtrace.

[1] https://lore.kernel.org/git/20250428194048.149348-1-code@xxxxxxxxxxxxxxx

Phillip Wood (2):
  sequencer: move reflog message functions
  sequencer: rework reflog message handling

 sequencer.c              | 116 +++++++++++++++++++--------------------
 t/t3430-rebase-merges.sh |  11 +++-
 2 files changed, 67 insertions(+), 60 deletions(-)


base-commit: 4bbb303af69990ccd05fe3a2eb58a1ce036f8220
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-1919%2Fphillipwood%2Fsequencer-explicit-reflog-message-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1919/phillipwood/sequencer-explicit-reflog-message-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/1919
-- 
gitgitgadget




[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]

  Powered by Linux