Commit fabacb7c6506f0cfb4cb29031855e50f00664b6b

Edward Thomson 2021-08-25T15:24:35

Merge pull request #6007 from boretrk/array array: check dereference from void * type

diff --git a/src/array.h b/src/array.h
index 03537e7..e649d84 100644
--- a/src/array.h
+++ b/src/array.h
@@ -70,13 +70,13 @@ on_oom:
 #define git_array_alloc(a) \
 	(((a).size >= (a).asize) ? \
 	git_array_grow(&(a), sizeof(*(a).ptr)) : \
-	((a).ptr ? &(a).ptr[(a).size++] : NULL))
+	((a).ptr ? &(a).ptr[(a).size++] : (void *)NULL))
 
-#define git_array_last(a) ((a).size ? &(a).ptr[(a).size - 1] : NULL)
+#define git_array_last(a) ((a).size ? &(a).ptr[(a).size - 1] : (void *)NULL)
 
-#define git_array_pop(a) ((a).size ? &(a).ptr[--(a).size] : NULL)
+#define git_array_pop(a) ((a).size ? &(a).ptr[--(a).size] : (void *)NULL)
 
-#define git_array_get(a, i) (((i) < (a).size) ? &(a).ptr[(i)] : NULL)
+#define git_array_get(a, i) (((i) < (a).size) ? &(a).ptr[(i)] : (void *)NULL)
 
 #define git_array_size(a) (a).size
 
diff --git a/src/diff_driver.c b/src/diff_driver.c
index e9f63cb..8e9131f 100644
--- a/src/diff_driver.c
+++ b/src/diff_driver.c
@@ -389,13 +389,13 @@ int git_diff_driver_lookup(
 
 void git_diff_driver_free(git_diff_driver *driver)
 {
-	size_t i;
+	git_diff_driver_pattern *pat;
 
 	if (!driver)
 		return;
 
-	for (i = 0; i < git_array_size(driver->fn_patterns); ++i)
-		git_regexp_dispose(& git_array_get(driver->fn_patterns, i)->re);
+	while ((pat = git_array_pop(driver->fn_patterns)) != NULL)
+		git_regexp_dispose(&pat->re);
 	git_array_clear(driver->fn_patterns);
 
 	git_regexp_dispose(&driver->word_pattern);
diff --git a/src/tree.c b/src/tree.c
index 76821e3..b1df79e 100644
--- a/src/tree.c
+++ b/src/tree.c
@@ -1251,8 +1251,9 @@ int git_tree_create_updated(git_oid *out, git_repository *repo, git_tree *baseli
 			}
 			case GIT_TREE_UPDATE_REMOVE:
 			{
+				tree_stack_entry *last = git_array_last(stack);
 				char *basename = git_path_basename(update->path);
-				error = git_treebuilder_remove(git_array_last(stack)->bld, basename);
+				error = git_treebuilder_remove(last->bld, basename);
 				git__free(basename);
 				break;
 			}