Skip to content

Commit

Permalink
builtin/blame: destroy initialized commit_info only
Browse files Browse the repository at this point in the history
Since ea02ffa (mailmap: simplify map_user() interface, 2013-01-05),
find_alignment() has been invoking commit_info_destroy() on an
uninitialized auto 'struct commit_info' (when METAINFO_SHOWN is not
set). commit_info_destroy() calls strbuf_release() for each
'commit_info' strbuf member, which randomly invokes free() on
whatever random stack value happens to reside in strbuf.buf, thus
leading to periodic crashes.

Reported-by: Dilyan Palauzov <dilyan.palauzov@aegee.org>
Signed-off-by: Eric Sunshine <sunshine@sunshineco.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
  • Loading branch information
Eric Sunshine authored and Junio C Hamano committed Feb 10, 2015
1 parent 3d8a54e commit e600592
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions builtin/blame.c
Original file line number Diff line number Diff line change
Expand Up @@ -1843,7 +1843,6 @@ static void find_alignment(struct scoreboard *sb, int *option)

for (e = sb->ent; e; e = e->next) {
struct origin *suspect = e->suspect;
struct commit_info ci;
int num;

if (compute_auto_abbrev)
Expand All @@ -1854,6 +1853,7 @@ static void find_alignment(struct scoreboard *sb, int *option)
if (longest_file < num)
longest_file = num;
if (!(suspect->commit->object.flags & METAINFO_SHOWN)) {
struct commit_info ci;
suspect->commit->object.flags |= METAINFO_SHOWN;
get_commit_info(suspect->commit, &ci, 1);
if (*option & OUTPUT_SHOW_EMAIL)
Expand All @@ -1862,6 +1862,7 @@ static void find_alignment(struct scoreboard *sb, int *option)
num = utf8_strwidth(ci.author.buf);
if (longest_author < num)
longest_author = num;
commit_info_destroy(&ci);
}
num = e->s_lno + e->num_lines;
if (longest_src_lines < num)
Expand All @@ -1871,8 +1872,6 @@ static void find_alignment(struct scoreboard *sb, int *option)
longest_dst_lines = num;
if (largest_score < ent_score(sb, e))
largest_score = ent_score(sb, e);

commit_info_destroy(&ci);
}
max_orig_digits = decimal_width(longest_src_lines);
max_digits = decimal_width(longest_dst_lines);
Expand Down

0 comments on commit e600592

Please sign in to comment.