From 6e454b9a31840102807f1eee527ee717bf134102 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Wed, 5 Jun 2013 18:37:39 -0400 Subject: clear parsed flag when we free tree buffers Many code paths will free a tree object's buffer and set it to NULL after finishing with it in order to keep memory usage down during a traversal. However, out of 8 sites that do this, only one actually unsets the "parsed" flag back. Those sites that don't are setting a trap for later users of the tree object; even after calling parse_tree, the buffer will remain NULL, causing potential segfaults. It is not known whether this is triggerable in the current code. Most commands do not do an in-memory traversal followed by actually using the objects again. However, it does not hurt to be safe for future callers. In most cases, we can abstract this out to a "free_tree_buffer" helper. However, there are two exceptions: 1. The fsck code relies on the parsed flag to know that we were able to parse the object at one point. We can switch this to using a flag in the "flags" field. 2. The index-pack code sets the buffer to NULL but does not free it (it is freed by a caller). We should still unset the parsed flag here, but we cannot use our helper, as we do not want to free the buffer. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- tree.c | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'tree.c') diff --git a/tree.c b/tree.c index 62fed632d..1cbf60ea2 100644 --- a/tree.c +++ b/tree.c @@ -225,6 +225,14 @@ int parse_tree(struct tree *item) return parse_tree_buffer(item, buffer, size); } +void free_tree_buffer(struct tree *tree) +{ + free(tree->buffer); + tree->buffer = NULL; + tree->size = 0; + tree->object.parsed = 0; +} + struct tree *parse_tree_indirect(const unsigned char *sha1) { struct object *obj = parse_object(sha1); -- cgit v1.2.1