http*: cleanup slot->local after fclose

Set slot->local to NULL after doing a fclose() on the file it points
to. This prevents the passing of a FILE* pointer to a fclose()'d file
to ftell() in http.c::run_active_slot().

This issue was raised by Clemens Buchacher on 30th May 2009:

  http://www.spinics.net/lists/git/msg104623.html

Signed-off-by: Tay Ray Chuan <rctay89@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/http-push.c b/http-push.c
index 5138224cc372482fb60afd350fa40e37d019f367..673a61110e9653a312e3d11bcdb049d181a3898f 100644 (file)
--- a/http-push.c
+++ b/http-push.c
@@ -724,9 +724,11 @@ static void finish_request(struct transfer_request *request)
        struct stat st;
        struct packed_git *target;
        struct packed_git **lst;
+       struct active_request_slot *slot;
 
        request->curl_result = request->slot->curl_result;
        request->http_code = request->slot->http_code;
+       slot = request->slot;
        request->slot = NULL;
 
        /* Keep locks active */
@@ -823,6 +825,7 @@ static void finish_request(struct transfer_request *request)
 
                        fclose(request->local_stream);
                        request->local_stream = NULL;
+                       slot->local = NULL;
                        if (!move_temp_to_file(request->tmpfile,
                                               request->filename)) {
                                target = (struct packed_git *)request->userData;
@@ -1024,17 +1027,20 @@ static int fetch_index(unsigned char *sha1)
                if (results.curl_result != CURLE_OK) {
                        free(url);
                        fclose(indexfile);
+                       slot->local = NULL;
                        return error("Unable to get pack index %s\n%s", url,
                                     curl_errorstr);
                }
        } else {
                free(url);
                fclose(indexfile);
+               slot->local = NULL;
                return error("Unable to start request");
        }
 
        free(url);
        fclose(indexfile);
+       slot->local = NULL;
 
        return move_temp_to_file(tmpfile, filename);
 }

diff --git a/http-walker.c b/http-walker.c
index c5a3ea3b31045be9407579a9d1aba222ee3e9914..ec1c97f2ee04a116e3c1bd22f2f8e2ad2963f5d3 100644 (file)
--- a/http-walker.c
+++ b/http-walker.c
@@ -418,15 +418,18 @@ static int fetch_index(struct walker *walker, struct alt_base *repo, unsigned ch
                run_active_slot(slot);
                if (results.curl_result != CURLE_OK) {
                        fclose(indexfile);
+                       slot->local = NULL;
                        return error("Unable to get pack index %s\n%s", url,
                                     curl_errorstr);
                }
        } else {
                fclose(indexfile);
+               slot->local = NULL;
                return error("Unable to start request");
        }
 
        fclose(indexfile);
+       slot->local = NULL;
 
        return move_temp_to_file(tmpfile, filename);
 }
@@ -776,16 +779,19 @@ static int fetch_pack(struct walker *walker, struct alt_base *repo, unsigned cha
                run_active_slot(slot);
                if (results.curl_result != CURLE_OK) {
                        fclose(packfile);
+                       slot->local = NULL;
                        return error("Unable to get pack file %s\n%s", url,
                                     curl_errorstr);
                }
        } else {
                fclose(packfile);
+               slot->local = NULL;
                return error("Unable to start request");
        }
 
        target->pack_size = ftell(packfile);
        fclose(packfile);
+       slot->local = NULL;
 
        ret = move_temp_to_file(tmpfile, filename);
        if (ret)