diff options
| author | Brandon Williams <bmwill@google.com> | 2017-04-07 12:29:19 -0700 |
|---|---|---|
| committer | Junio C Hamano <gitster@pobox.com> | 2017-04-16 18:04:06 -0700 |
| commit | 5ce10c0a29efeab21567228f8916190f2202fdb3 (patch) | |
| tree | 8673aab4b15ff406fa4448f884cb87590713111a /pathspec.c | |
| parent | c5af19f9ab4cd8582689ca9d9c84f188f4442d10 (diff) | |
| download | git-5ce10c0a29efeab21567228f8916190f2202fdb3.tar.gz git-5ce10c0a29efeab21567228f8916190f2202fdb3.tar.xz | |
pathspec: fix segfault in clear_pathspec
In 'clear_pathspec()' the incorrect index parameter is used to bound an
inner-loop which is used to free a 'struct attr_match' value field.
Using the incorrect index parameter (in addition to being incorrect)
occasionally causes segmentation faults when attempting to free an
invalid pointer. Fix this by using the correct index parameter 'i'.
Signed-off-by: Brandon Williams <bmwill@google.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'pathspec.c')
| -rw-r--r-- | pathspec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pathspec.c b/pathspec.c index 303efda83..69ef86b85 100644 --- a/pathspec.c +++ b/pathspec.c @@ -724,7 +724,7 @@ void clear_pathspec(struct pathspec *pathspec) free(pathspec->items[i].match); free(pathspec->items[i].original); - for (j = 0; j < pathspec->items[j].attr_match_nr; j++) + for (j = 0; j < pathspec->items[i].attr_match_nr; j++) free(pathspec->items[i].attr_match[j].value); free(pathspec->items[i].attr_match); |