Subject: [PATCH 05/14] verify_commit_graph(): defensive programming

From: "Johannes Schindelin via GitGitGadget" <[email-masked]>
Date: Thu, 15 May 2025 12:45:30 +0000

From: Johannes Schindelin <[email-masked]>

CodeQL points out that `lookup_commit()` can return NULL values.

Signed-off-by: Johannes Schindelin <[email-masked]>
---
 commit-graph.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/commit-graph.c b/commit-graph.c
index 1021ccb983d4..b3696736d248 100644
--- a/commit-graph.c
+++ b/commit-graph.c
@@ -2786,6 +2786,11 @@ static int verify_one_commit_graph(struct repository *r,
 			the_repository->hash_algo);
 
 		graph_commit = lookup_commit(r, &cur_oid);
+		if (!graph_commit) {
+			graph_report(_("failed to look up commit %s for commit-graph"),
+				     oid_to_hex(&cur_oid));
+			continue;
+		}
 		odb_commit = (struct commit *)create_object(r, &cur_oid, alloc_commit_node(r));
 		if (repo_parse_commit_internal(r, odb_commit, 0, 0)) {
 			graph_report(_("failed to parse commit %s from object database for commit-graph"),
-- 
gitgitgadget