Commit 7d1b1774 by Patrick Steinhardt

cache: fix invalid memory access in case updating cache entry fails

When adding a new entry to our cache where an entry with the same OID
exists already, then we only update the existing entry in case it is
unparsed and the new entry is parsed. Currently, we do not check the
return value of `git_oidmap_set` though when updating the existing
entry. As a result, we will _not_ have updated the existing entry if
`git_oidmap_set` fails, but have decremented its refcount and
incremented the new entry's refcount. Later on, this may likely lead to
dereferencing invalid memory.

Fix the issue by checking the return value of `git_oidmap_set`. In case
it fails, we will simply keep the existing stored instead, even though
it's unparsed.
parent 775af015
......@@ -208,10 +208,14 @@ static void *cache_store(git_cache *cache, git_cached_obj *entry)
entry = stored_entry;
} else if (stored_entry->flags == GIT_CACHE_STORE_RAW &&
entry->flags == GIT_CACHE_STORE_PARSED) {
if (git_oidmap_set(cache->map, &entry->oid, entry) == 0) {
git_cached_obj_decref(stored_entry);
git_cached_obj_incref(entry);
git_oidmap_set(cache->map, &entry->oid, entry);
} else {
git_cached_obj_decref(entry);
git_cached_obj_incref(stored_entry);
entry = stored_entry;
}
} else {
/* NO OP */
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment