Skip to content

filesystem_iterator: fixed double free on error#3904

Merged
pks-t merged 1 commit into
libgit2:masterfrom
stinb:filesystem-iterator-double-free
Aug 24, 2016
Merged

filesystem_iterator: fixed double free on error#3904
pks-t merged 1 commit into
libgit2:masterfrom
stinb:filesystem-iterator-double-free

Conversation

@hackhaslam

Copy link
Copy Markdown
Contributor

git_iterator_free tries to free iter->root (and iter->current_path) via the filesystem_iterator_free callback after it has already been freed. I couldn't figure out what caused the on_error case to begin with or else I would have tried to make a test case.

@pks-t

pks-t commented Aug 22, 2016

Copy link
Copy Markdown
Member

The fix as-is does not suffice, unfortunately. Problem is that we may jump to the on_error label previous to initializing iterator->base.cb, where we call git_iterator_free(&iterator->base). But git_iterator_free will dereference iterator->base.cb->free then, leading to undefined behavior.

So in addition to your improvement, we should also move up initialization of the callbacks.

@hackhaslam hackhaslam force-pushed the filesystem-iterator-double-free branch from df2552d to 7a3f1de Compare August 22, 2016 15:28
@hackhaslam

Copy link
Copy Markdown
Contributor Author

Ugh, sorry. You're right. I didn't pay close enough attention to where the callbacks are set. I moved the initialization of the base members above the initialization of the filesystem members.

@pks-t

pks-t commented Aug 23, 2016

Copy link
Copy Markdown
Member

No worries, the error existed already before you touching the code. Thanks for the fix. I'll wait another day for comments and then merge tomorrow if none are incoming.

@pks-t pks-t merged commit c60210d into libgit2:master Aug 24, 2016
@ethomson

Copy link
Copy Markdown
Member

Thanks @hackhaslam ! ❤️

@hackhaslam hackhaslam deleted the filesystem-iterator-double-free branch August 24, 2016 15:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants