From cc7510f3dbec5828df12ff3dfae7864efc62e37b Mon Sep 17 00:00:00 2001 From: Olof Fairbrook Date: Sun, 18 Oct 2026 16:21:29 +0200 Subject: [PATCH] bundle: do not free uninitialized memory on bad arguments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit "git bundle create" gives up with an error when setup_revisions() leaves an argument it does not understand, as in $ git bundle create private.bundle main --no-such-option error: unrecognized argument: --no-such-option Since 11ee9a75e7 (bundle: plug leaks in `create_bundle()`, 2024-06-11), that error jumps to the cleanup at the end of create_bundle(), which clears "revs_copy.pending". But "revs_copy" is only filled from "revs" further down, so the cleanup reads uninitialized stack memory and may free a garbage pointer. valgrind reports "Conditional jump or move depends on uninitialised value(s)" in object_array_clear() and in free(); whether the command crashes depends on what happens to be on the stack. Give “revs_copy” its value where it is declared, and add a test that fails under valgrind without this fix. Signed-off-by: Olof Fairbrook Signed-off-by: Junio C Hamano --- bundle.c | 2 +- t/t5607-clone-bundle.sh | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/bundle.c b/bundle.c index f55a521b2a..aad5f251ca 100644 --- a/bundle.c +++ b/bundle.c @@ -492,7 +492,7 @@ int create_bundle(struct repository *r, const char *path, int bundle_fd = -1; int bundle_to_stdout; int ref_count = 0; - struct rev_info revs, revs_copy; + struct rev_info revs, revs_copy = { 0 }; int min_version = 2; struct bundle_prerequisites_info bpi; int ret; diff --git a/t/t5607-clone-bundle.sh b/t/t5607-clone-bundle.sh index d709bea753..c39db5a955 100755 --- a/t/t5607-clone-bundle.sh +++ b/t/t5607-clone-bundle.sh @@ -127,6 +127,13 @@ test_expect_success 'failed bundle creation does not leave cruft' ' test_path_is_missing fail.bundle.lock ' +test_expect_success 'an unknown argument after the revisions is an error' ' + test_must_fail git bundle create unknown.bundle main --no-such-option \ + 2>err && + test_grep "unrecognized argument: --no-such-option" err && + test_path_is_missing unknown.bundle +' + test_expect_success 'fetch SHA-1 from bundle' ' test_create_repo foo && test_commit -C foo x &&