aboutsummaryrefslogtreecommitdiff
path: root/builtin
diff options
context:
space:
mode:
authorJunio C Hamano <gitster@pobox.com>2016-03-21 12:01:43 -0700
committerJunio C Hamano <gitster@pobox.com>2016-03-23 10:12:10 -0700
commitb84e65d40929ec1146f54dcf4c9dbf8dc58467d0 (patch)
tree666e5f863b994cc9289bfa61be40f4d23b6566dd /builtin
parenta0feb1b1870fbb74f65d6a8951e4b2e2a2347ecf (diff)
downloadgit-b84e65d40929ec1146f54dcf4c9dbf8dc58467d0.tar.gz
git-b84e65d40929ec1146f54dcf4c9dbf8dc58467d0.tar.xz
merge: fix NULL pointer dereference when merging nothing into void
When we are on an unborn branch and merging only one foreign parent, we allow "git merge" to fast-forward to that foreign parent commit. This codepath incorrectly attempted to dereference the list of parents that the merge is going to record even when the list is empty. It must refuse to operate instead when there is no parent. All other codepaths make sure the list is not empty before they dereference it, and are safe. Reported-by: Jose Ivan B. Vilarouca Filho Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'builtin')
-rw-r--r--builtin/merge.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/builtin/merge.c b/builtin/merge.c
index 101ffeff4..bf2f2614f 100644
--- a/builtin/merge.c
+++ b/builtin/merge.c
@@ -1257,12 +1257,12 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
builtin_merge_options);
if (!head_commit) {
- struct commit *remote_head;
/*
* If the merged head is a valid one there is no reason
* to forbid "git merge" into a branch yet to be born.
* We do the same for "git pull".
*/
+ unsigned char *remote_head_sha1;
if (squash)
die(_("Squash commit into empty head not supported yet"));
if (fast_forward == FF_NO)
@@ -1270,13 +1270,13 @@ int cmd_merge(int argc, const char **argv, const char *prefix)
"an empty head"));
remoteheads = collect_parents(head_commit, &head_subsumed,
argc, argv, NULL);
- remote_head = remoteheads->item;
- if (!remote_head)
+ if (!remoteheads)
die(_("%s - not something we can merge"), argv[0]);
if (remoteheads->next)
die(_("Can merge only exactly one commit into empty head"));
- read_empty(remote_head->object.oid.hash, 0);
- update_ref("initial pull", "HEAD", remote_head->object.oid.hash,
+ remote_head_sha1 = remoteheads->item->object.oid.hash;
+ read_empty(remote_head_sha1, 0);
+ update_ref("initial pull", "HEAD", remote_head_sha1,
NULL, 0, UPDATE_REFS_DIE_ON_ERR);
goto done;
}