Message ID | 20240924221113.GA1143820@coredump.intra.peff.net (mailing list archive) |
---|---|
State | Accepted |
Commit | 9699327945d16f67f8a20a299d63621a3b1d3cd2 |
Headers | show |
Series | leak fixes for http fetch/push | expand |
diff --git a/http-push.c b/http-push.c index 1cddd2fb37..b36b1f9e35 100644 --- a/http-push.c +++ b/http-push.c @@ -582,9 +582,10 @@ static void finish_request(struct transfer_request *request) if (obj_req->rename == 0) request->obj->flags |= (LOCAL | REMOTE); + release_http_object_request(&obj_req); + /* Try fetching packed if necessary */ if (request->obj->flags & LOCAL) { - release_http_object_request(&obj_req); release_request(request); } else start_fetch_packed(request);
In http-push's finish_request(), if we fail a loose object request we may fall back to trying a packed request. But if we do so, we leave the http_loose_object_request in place, leaking it. We can fix this by always cleaning it up. Note that the obj_req pointer here (which we'll set to NULL) is a copy of the request->userData pointer, which will now point to freed memory. But that's OK. We'll either release the parent request struct entirely, or we'll convert it into a packed request, which will overwrite userData itself. This leak is found by t5540, but it's not quite leak-free yet. Signed-off-by: Jeff King <peff@peff.net> --- http-push.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)