t4211: log: demonstrate -L bounds checking bug

diff --git a/refs.c b/refs.c
index a3f2302292190b147a1cee092a26d47ace7a1228..7b08a37153457d335ecf676a73252aa5bdbee4fb 100644 (file)
--- a/refs.c
+++ b/refs.c
@@ -634,7 +634,9 @@ struct ref_entry_cb {
 static int do_one_ref(struct ref_entry *entry, void *cb_data)
 {
        struct ref_entry_cb *data = cb_data;
+       struct ref_entry *old_current_ref;
        int retval;
+
        if (prefixcmp(entry->name, data->base))
                return 0;
 
@@ -642,10 +644,12 @@ static int do_one_ref(struct ref_entry *entry, void *cb_data)
              !ref_resolves_to_object(entry))
                return 0;
 
+       /* Store the old value, in case this is a recursive call: */
+       old_current_ref = current_ref;
        current_ref = entry;
        retval = data->fn(entry->name + data->trim, entry->u.value.sha1,
                          entry->flag, data->cb_data);
-       current_ref = NULL;
+       current_ref = old_current_ref;
        return retval;
 }