Merge branch 'maint'

* maint:
http-push.c::remove_locks(): fix use after free

diff --combined http-push.c
index dac2c6e0524e3051ca98bfb4d75fbc81efe91eef,9da14201b158f9118c1ece8519672875d4bb96e2..45e8a69e2d6b83f5a1564e7d1fe40d783d87ae3e
--- 1/http-push.c
--- 2/http-push.c
+++ b/http-push.c
@@@ -315,9 -315,9 +315,9 @@@ static void start_fetch_loose(struct tr
                 "%s.temp", filename);
  
        snprintf(prevfile, sizeof(prevfile), "%s.prev", request->filename);
 -      unlink(prevfile);
 +      unlink_or_warn(prevfile);
        rename(request->tmpfile, prevfile);
 -      unlink(request->tmpfile);
 +      unlink_or_warn(request->tmpfile);
  
        if (request->local_fileno != -1)
                error("fd leakage in start: %d", request->local_fileno);
@@@ -372,7 -372,7 +372,7 @@@
                } while (prev_read > 0);
                close(prevlocal);
        }
 -      unlink(prevfile);
 +      unlink_or_warn(prevfile);
  
        /* Reset inflate/SHA1 if there was an error reading the previous temp
           file; also rewind to the beginning of the local file. */
@@@ -784,7 -784,7 +784,7 @@@ static void finish_request(struct trans
                    request->http_code != 416) {
                        if (stat(request->tmpfile, &st) == 0) {
                                if (st.st_size == 0)
 -                                      unlink(request->tmpfile);
 +                                      unlink_or_warn(request->tmpfile);
                        }
                } else {
                        if (request->http_code == 416)
@@@ -793,9 -793,9 +793,9 @@@
                        git_inflate_end(&request->stream);
                        git_SHA1_Final(request->real_sha1, &request->c);
                        if (request->zret != Z_STREAM_END) {
 -                              unlink(request->tmpfile);
 +                              unlink_or_warn(request->tmpfile);
                        } else if (hashcmp(request->obj->sha1, request->real_sha1)) {
 -                              unlink(request->tmpfile);
 +                              unlink_or_warn(request->tmpfile);
                        } else {
                                request->rename =
                                        move_temp_to_file(
@@@ -1415,8 -1415,9 +1415,9 @@@ static void remove_locks(void
  
        fprintf(stderr, "Removing remote locks...\n");
        while (lock) {
+               struct remote_lock *next = lock->next;
                unlock_remote(lock);
-               lock = lock->next;
+               lock = next;
        }
  }
  
@@@ -2326,7 -2327,7 +2327,7 @@@ int main(int argc, char **argv
        new_refs = 0;
        for (ref = remote_refs; ref; ref = ref->next) {
                char old_hex[60], *new_hex;
 -              const char *commit_argv[4];
 +              const char *commit_argv[5];
                int commit_argc;
                char *new_sha1_hex, *old_sha1_hex;
  
@@@ -2406,7 -2407,6 +2407,7 @@@
                        commit_argv[3] = old_sha1_hex;
                        commit_argc++;
                }
 +              commit_argv[commit_argc] = NULL;
                init_revisions(&revs, setup_git_directory());
                setup_revisions(commit_argc, commit_argv, &revs, NULL);
                revs.edge_hint = 0; /* just in case */