checkout: check return value of resolve_refdup before using hash
authorRené Scharfe <l.s.r@web.de>
Sat, 6 May 2017 17:13:52 +0000 (19:13 +0200)
committerJunio C Hamano <gitster@pobox.com>
Mon, 8 May 2017 02:12:09 +0000 (11:12 +0900)
If resolve_refdup() fails it returns NULL and possibly leaves its hash
output parameter untouched. Make sure to use it only if the function
succeeded, in order to avoid accessing uninitialized memory.

Found with t/t2011-checkout-invalid-head.sh --valgrind.

Signed-off-by: Rene Scharfe <l.s.r@web.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
builtin/checkout.c
index 81f07c3ef271db08e36ee7a89b1d128d099ecb96..5744499098e6c2a4c92879af9118ff3a2c6ba0ae 100644 (file)
@@ -814,7 +814,8 @@ static int switch_branches(const struct checkout_opts *opts,
        int flag, writeout_error = 0;
        memset(&old, 0, sizeof(old));
        old.path = path_to_free = resolve_refdup("HEAD", 0, rev.hash, &flag);
-       old.commit = lookup_commit_reference_gently(rev.hash, 1);
+       if (old.path)
+               old.commit = lookup_commit_reference_gently(rev.hash, 1);
        if (!(flag & REF_ISSYMREF))
                old.path = NULL;