From e4cd6c7a20bfc776086817671d58e09060a8079a Mon Sep 17 00:00:00 2001 From: "Shawn O. Pearce" Date: Fri, 14 Sep 2007 18:57:11 -0400 Subject: [PATCH] Backup the array passed to fetch_pack so we can free items fetch_pack() can call remove_duplicates() on its input array and this will possibly overwrite an earlier entry with a later one if there are any duplicates in the input array. In such a case the caller here might then attempt to free an item multiple times as it goes through its cleanup. I also forgot to free the heads array we pass down into fetch_pack() when I introduced the allocation of it in this function during my builtin-fetch cleanup series. Better free it while we are here working on related memory management fixes. Signed-off-by: Shawn O. Pearce Signed-off-by: Junio C Hamano --- transport.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/transport.c b/transport.c index 0882edd38..0338ed45b 100644 --- a/transport.c +++ b/transport.c @@ -311,6 +311,7 @@ static int fetch_refs_via_pack(struct transport *transport, { struct git_transport_data *data = transport->data; char **heads = xmalloc(nr_heads * sizeof(*heads)); + char **origh = xmalloc(nr_heads * sizeof(*origh)); struct ref *refs; char *dest = xstrdup(transport->url); struct fetch_pack_args args; @@ -329,11 +330,13 @@ static int fetch_refs_via_pack(struct transport *transport, setup_fetch_pack(&args); for (i = 0; i < nr_heads; i++) - heads[i] = xstrdup(to_fetch[i]->name); + origh[i] = heads[i] = xstrdup(to_fetch[i]->name); refs = fetch_pack(dest, nr_heads, heads, &transport->pack_lockfile); for (i = 0; i < nr_heads; i++) - free(heads[i]); + free(origh[i]); + free(origh); + free(heads); free_refs(refs); free(dest); return 0; -- 2.30.2