Subject: [PATCH 03/14] fetch-pack: defensive programming

From: "Johannes Schindelin via GitGitGadget" <[email-masked]>
Date: Thu, 15 May 2025 12:45:28 +0000

From: Johannes Schindelin <[email-masked]>

CodeQL points out that `parse_object()` can return NULL values.

Signed-off-by: Johannes Schindelin <[email-masked]>
---
 fetch-pack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fetch-pack.c b/fetch-pack.c
index 1ed5e11dd568..4cbcb0c14c48 100644
--- a/fetch-pack.c
+++ b/fetch-pack.c
@@ -155,7 +155,7 @@ static struct commit *deref_without_lazy_fetch(const struct object_id *oid,
 			struct tag *tag = (struct tag *)
 				parse_object(the_repository, oid);
 
-			if (!tag->tagged)
+			if (!tag || !tag->tagged)
 				return NULL;
 			if (mark_tags_complete_and_check_obj_db)
 				tag->object.flags |= COMPLETE;
-- 
gitgitgadget