Subject: [PATCH 07/14] stash: defensive programming

From: "Johannes Schindelin via GitGitGadget" <[email-masked]>
Date: Thu, 15 May 2025 12:45:32 +0000

From: Johannes Schindelin <[email-masked]>

CodeQL points out that `lookup_commit()` can return NULL values.

Signed-off-by: Johannes Schindelin <[email-masked]>
---
 builtin/stash.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/builtin/stash.c b/builtin/stash.c
index 23c4bbd3e21e..8efcd31d6c61 100644
--- a/builtin/stash.c
+++ b/builtin/stash.c
@@ -1396,6 +1396,11 @@ static int do_create_stash(const struct pathspec *ps, struct strbuf *stash_msg_b
 		goto done;
 	} else {
 		head_commit = lookup_commit(the_repository, &info->b_commit);
+		if (!head_commit) {
+			ret = error(_("could not look up commit '%s'"),
+				    oid_to_hex (&info->b_commit));
+			goto done;
+		}
 	}
 
 	if (!check_changes(ps, include_untracked, &untracked_files)) {
-- 
gitgitgadget