Skip to content

Commit 7d1b177

Browse files
committed
cache: fix invalid memory access in case updating cache entry fails
When adding a new entry to our cache where an entry with the same OID exists already, then we only update the existing entry in case it is unparsed and the new entry is parsed. Currently, we do not check the return value of `git_oidmap_set` though when updating the existing entry. As a result, we will _not_ have updated the existing entry if `git_oidmap_set` fails, but have decremented its refcount and incremented the new entry's refcount. Later on, this may likely lead to dereferencing invalid memory. Fix the issue by checking the return value of `git_oidmap_set`. In case it fails, we will simply keep the existing stored instead, even though it's unparsed.
1 parent 775af01 commit 7d1b177

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

src/cache.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -208,10 +208,14 @@ static void *cache_store(git_cache *cache, git_cached_obj *entry)
208208
entry = stored_entry;
209209
} else if (stored_entry->flags == GIT_CACHE_STORE_RAW &&
210210
entry->flags == GIT_CACHE_STORE_PARSED) {
211-
git_cached_obj_decref(stored_entry);
212-
git_cached_obj_incref(entry);
213-
214-
git_oidmap_set(cache->map, &entry->oid, entry);
211+
if (git_oidmap_set(cache->map, &entry->oid, entry) == 0) {
212+
git_cached_obj_decref(stored_entry);
213+
git_cached_obj_incref(entry);
214+
} else {
215+
git_cached_obj_decref(entry);
216+
git_cached_obj_incref(stored_entry);
217+
entry = stored_entry;
218+
}
215219
} else {
216220
/* NO OP */
217221
}

0 commit comments

Comments
 (0)