Backup the array passed to fetch_pack so we can free items

fetch_pack() can call remove_duplicates() on its input array and
this will possibly overwrite an earlier entry with a later one if
there are any duplicates in the input array.  In such a case the
caller here might then attempt to free an item multiple times as
it goes through its cleanup.

I also forgot to free the heads array we pass down into fetch_pack()
when I introduced the allocation of it in this function during my
builtin-fetch cleanup series.  Better free it while we are here
working on related memory management fixes.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/transport.c b/transport.c
index 0882edd381fdd191974a0a5af64c2e1ff4b9015c..0338ed45b9bdc6f8c3300674a4c12e74db4a9b2c 100644 (file)
--- a/transport.c
+++ b/transport.c
@@ -311,6 +311,7 @@ static int fetch_refs_via_pack(struct transport *transport,
 {
        struct git_transport_data *data = transport->data;
        char **heads = xmalloc(nr_heads * sizeof(*heads));
+       char **origh = xmalloc(nr_heads * sizeof(*origh));
        struct ref *refs;
        char *dest = xstrdup(transport->url);
        struct fetch_pack_args args;
@@ -329,11 +330,13 @@ static int fetch_refs_via_pack(struct transport *transport,
        setup_fetch_pack(&args);
 
        for (i = 0; i < nr_heads; i++)
-               heads[i] = xstrdup(to_fetch[i]->name);
+               origh[i] = heads[i] = xstrdup(to_fetch[i]->name);
        refs = fetch_pack(dest, nr_heads, heads, &transport->pack_lockfile);
 
        for (i = 0; i < nr_heads; i++)
-               free(heads[i]);
+               free(origh[i]);
+       free(origh);
+       free(heads);
        free_refs(refs);
        free(dest);
        return 0;