summary refs log tree commit diff
path: root/ref-filter.c
diff options
context:
space:
mode:
authorJeff King <peff@peff.net>2021-04-01 04:32:24 -0400
committerJunio C Hamano <gitster@pobox.com>2021-04-01 12:54:21 -0700
commitc6854508808dd32e3fc20c5b021c4064d25f6438 (patch)
tree676c646da413b954fb09eb24688d014bcb50ba14 /ref-filter.c
parent0628636d0c21324ae0f11be591611c6b1e55705f (diff)
ref-filter: fix NULL check for parse object failure
After we run parse_object_buffer() to get an object's contents, we try
to check that the return value wasn't NULL. However, since our "struct
object" is a pointer-to-pointer, and we assign like:

  *obj = parse_object_buffer(...);

it's not correct to check:

  if (!obj)

That will always be true, since our double pointer will continue to
point to the single pointer (which is itself NULL). This is a regression
that was introduced by aa46a0da30 (ref-filter: use oid_object_info() to
get object, 2018-07-17); since that commit we'll segfault on a parse
failure, as we try to look at the NULL object pointer.

There are many ways a parse could fail, but most of them are hard to set
up in the tests (it's easy to make a bogus object, but update-ref will
refuse to point to it). The test here uses a tag which points to a wrong
object type. A parse of just the broken tag object will succeed, but
seeing both tag objects in the same process will lead to a parse error
(since we'll see the pointed-to object as both types).

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Diffstat (limited to 'ref-filter.c')
-rw-r--r--ref-filter.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/ref-filter.c b/ref-filter.c
index c62f6b4822..d79b7a2c74 100644
--- a/ref-filter.c
+++ b/ref-filter.c
@@ -1595,7 +1595,7 @@ static int get_object(struct ref_array_item *ref, int deref, struct object **obj
 
 	if (oi->info.contentp) {
 		*obj = parse_object_buffer(the_repository, &oi->oid, oi->type, oi->size, oi->content, &eaten);
-		if (!obj) {
+		if (!*obj) {
 			if (!eaten)
 				free(oi->content);
 			return strbuf_addf_ret(err, -1, _("parse_object_buffer failed on %s for %s"),