linear-assignment: fix potential out of bounds memory access

diff --git a/object.c b/object.c
index f41f82c6725e7bdbb4aa53d672863273abb48bf2..e2c112cc1a757f666ce3ca234227c98abf146910 100644 (file)
--- a/object.c
+++ b/object.c
@@ -9,6 +9,7 @@
 #include "alloc.h"
 #include "object-store.h"
 #include "packfile.h"
+#include "commit-graph.h"
 
 unsigned int get_max_object_index(void)
 {
@@ -84,21 +85,20 @@ static void insert_obj_hash(struct object *obj, struct object **hash, unsigned i
  * Look up the record for the given sha1 in the hash map stored in
  * obj_hash.  Return NULL if it was not found.
  */
-struct object *lookup_object_the_repository(const unsigned char *sha1)
+struct object *lookup_object(struct repository *r, const unsigned char *sha1)
 {
        unsigned int i, first;
        struct object *obj;
 
-       if (!the_repository->parsed_objects->obj_hash)
+       if (!r->parsed_objects->obj_hash)
                return NULL;
 
-       first = i = hash_obj(sha1,
-                            the_repository->parsed_objects->obj_hash_size);
-       while ((obj = the_repository->parsed_objects->obj_hash[i]) != NULL) {
+       first = i = hash_obj(sha1, r->parsed_objects->obj_hash_size);
+       while ((obj = r->parsed_objects->obj_hash[i]) != NULL) {
                if (!hashcmp(sha1, obj->oid.hash))
                        break;
                i++;
-               if (i == the_repository->parsed_objects->obj_hash_size)
+               if (i == r->parsed_objects->obj_hash_size)
                        i = 0;
        }
        if (obj && i != first) {
@@ -107,8 +107,8 @@ struct object *lookup_object_the_repository(const unsigned char *sha1)
                 * that we do not need to walk the hash table the next
                 * time we look for it.
                 */
-               SWAP(the_repository->parsed_objects->obj_hash[i],
-                    the_repository->parsed_objects->obj_hash[first]);
+               SWAP(r->parsed_objects->obj_hash[i],
+                    r->parsed_objects->obj_hash[first]);
        }
        return obj;
 }
@@ -186,21 +186,21 @@ struct object *lookup_unknown_object(const unsigned char *sha1)
        return obj;
 }
 
-struct object *parse_object_buffer_the_repository(const struct object_id *oid, enum object_type type, unsigned long size, void *buffer, int *eaten_p)
+struct object *parse_object_buffer(struct repository *r, const struct object_id *oid, enum object_type type, unsigned long size, void *buffer, int *eaten_p)
 {
        struct object *obj;
        *eaten_p = 0;
 
        obj = NULL;
        if (type == OBJ_BLOB) {
-               struct blob *blob = lookup_blob(the_repository, oid);
+               struct blob *blob = lookup_blob(r, oid);
                if (blob) {
                        if (parse_blob_buffer(blob, buffer, size))
                                return NULL;
                        obj = &blob->object;
                }
        } else if (type == OBJ_TREE) {
-               struct tree *tree = lookup_tree(the_repository, oid);
+               struct tree *tree = lookup_tree(r, oid);
                if (tree) {
                        obj = &tree->object;
                        if (!tree->buffer)
@@ -212,20 +212,20 @@ struct object *parse_object_buffer_the_repository(const struct object_id *oid, e
                        }
                }
        } else if (type == OBJ_COMMIT) {
-               struct commit *commit = lookup_commit(the_repository, oid);
+               struct commit *commit = lookup_commit(r, oid);
                if (commit) {
-                       if (parse_commit_buffer(the_repository, commit, buffer, size, 1))
+                       if (parse_commit_buffer(r, commit, buffer, size, 1))
                                return NULL;
-                       if (!get_cached_commit_buffer(the_repository, commit, NULL)) {
-                               set_commit_buffer(the_repository, commit, buffer, size);
+                       if (!get_cached_commit_buffer(r, commit, NULL)) {
+                               set_commit_buffer(r, commit, buffer, size);
                                *eaten_p = 1;
                        }
                        obj = &commit->object;
                }
        } else if (type == OBJ_TAG) {
-               struct tag *tag = lookup_tag(the_repository, oid);
+               struct tag *tag = lookup_tag(r, oid);
                if (tag) {
-                       if (parse_tag_buffer(the_repository, tag, buffer, size))
+                       if (parse_tag_buffer(r, tag, buffer, size))
                               return NULL;
                        obj = &tag->object;
                }
@@ -246,28 +246,28 @@ struct object *parse_object_or_die(const struct object_id *oid,
        die(_("unable to parse object: %s"), name ? name : oid_to_hex(oid));
 }
 
-struct object *parse_object_the_repository(const struct object_id *oid)
+struct object *parse_object(struct repository *r, const struct object_id *oid)
 {
        unsigned long size;
        enum object_type type;
        int eaten;
-       const struct object_id *repl = lookup_replace_object(the_repository, oid);
+       const struct object_id *repl = lookup_replace_object(r, oid);
        void *buffer;
        struct object *obj;
 
-       obj = lookup_object(the_repository, oid->hash);
+       obj = lookup_object(r, oid->hash);
        if (obj && obj->parsed)
                return obj;
 
        if ((obj && obj->type == OBJ_BLOB && has_object_file(oid)) ||
            (!obj && has_object_file(oid) &&
-            oid_object_info(the_repository, oid, NULL) == OBJ_BLOB)) {
+            oid_object_info(r, oid, NULL) == OBJ_BLOB)) {
                if (check_object_signature(repl, NULL, 0, NULL) < 0) {
                        error("sha1 mismatch %s", oid_to_hex(oid));
                        return NULL;
                }
-               parse_blob_buffer(lookup_blob(the_repository, oid), NULL, 0);
-               return lookup_object(the_repository, oid->hash);
+               parse_blob_buffer(lookup_blob(r, oid), NULL, 0);
+               return lookup_object(r, oid->hash);
        }
 
        buffer = read_object_file(oid, &type, &size);
@@ -278,7 +278,7 @@ struct object *parse_object_the_repository(const struct object_id *oid)
                        return NULL;
                }
 
-               obj = parse_object_buffer(the_repository, oid, type, size,
+               obj = parse_object_buffer(r, oid, type, size,
                                          buffer, &eaten);
                if (!eaten)
                        free(buffer);
@@ -468,6 +468,8 @@ struct parsed_object_pool *parsed_object_pool_new(void)
        o->is_shallow = -1;
        o->shallow_stat = xcalloc(1, sizeof(*o->shallow_stat));
 
+       o->buffer_slab = allocate_commit_buffer_slab();
+
        return o;
 }
 
@@ -506,6 +508,10 @@ void raw_object_store_clear(struct raw_object_store *o)
        oidmap_free(o->replace_map, 1);
        FREE_AND_NULL(o->replace_map);
 
+       free_commit_graph(o->commit_graph);
+       o->commit_graph = NULL;
+       o->commit_graph_attempted = 0;
+
        free_alt_odbs(o);
        o->alt_odb_tail = NULL;
 
@@ -542,6 +548,9 @@ void parsed_object_pool_clear(struct parsed_object_pool *o)
        FREE_AND_NULL(o->obj_hash);
        o->obj_hash_size = 0;
 
+       free_commit_buffer_slab(o->buffer_slab);
+       o->buffer_slab = NULL;
+
        clear_alloc_state(o->blob_state);
        clear_alloc_state(o->tree_state);
        clear_alloc_state(o->commit_state);