Repository navigation
Conversation
clone::nonetwork::clone_tag_to_tree, repo::getters::commit_parents and worktree::worktree::list_without_worktrees free the repository that cl_git_sandbox_init returned, but clar still points at it, and their suites' cleanup doesn't call cl_git_sandbox_cleanup. The next cl_git_sandbox_init replaces the pointer, but a cleanup that calls cl_git_sandbox_cleanup first frees the repository again: running clone::nonetwork::clone_tag_to_tree and then network::fetchlocal under ASan reports a heap-use-after-free in git_repository_free. Use cl_git_sandbox_cleanup, which frees the repository, forgets it and removes the sandbox.
msuozzo
force-pushed
the
push-mrpsrpxzxlzz
branch
from
October 12, 2026 04:09
eb17cc6 to
e1b1856
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
clone::nonetwork::clone_tag_to_tree,repo::getters::commit_parentsandworktree::worktree::list_without_worktreesfree the repository thatcl_git_sandbox_initreturned, but clar still points at it, and their suites' cleanup doesn't callcl_git_sandbox_cleanup. The nextcl_git_sandbox_initreplaces the pointer, but a cleanup that callscl_git_sandbox_cleanupfirst frees the repository again. Runningclone::nonetwork::clone_tag_to_treeand thennetwork::fetchlocalunder ASan reports a heap-use-after-free ingit_repository_free.This uses
cl_git_sandbox_cleanupinstead, which frees the repository, forgets it and removes the sandbox.The worktree fixture does the same with the repositories it opens; #7411 fixes that separately.