Subject: [PATCH 0/2] Sequencer: avoid use-after-free when creating merges

From: "Phillip Wood via GitGitGadget" <[email-masked]>
Date: Fri, 09 May 2025 16:22:25 +0000

This series fixes a use-after-free bug reported in [1]. The bug is caused by
storing a pointer to the buffer in a static strbuf that gets reallocated.
There was some discussion about removing the buffer and making the caller
responsible for freeing the returned string. In the end I decided to keep
the buffer as it avoids having to remember to free the return value and
instead stop storing the pointer to it in a long-lived variable.

Many thanks to Kristoffer for the detailed bug report and backtrace.

[1] https://lore.kernel.org/git/[email-masked]

Phillip Wood (2):
  sequencer: move reflog message functions
  sequencer: rework reflog message handling

 sequencer.c              | 116 +++++++++++++++++++--------------------
 t/t3430-rebase-merges.sh |  11 +++-
 2 files changed, 67 insertions(+), 60 deletions(-)

base-commit: 4bbb303af69990ccd05fe3a2eb58a1ce036f8220
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-1919%2Fphillipwood%2Fsequencer-explicit-reflog-message-v1
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-1919/phillipwood/sequencer-explicit-reflog-message-v1
Pull-Request: https://github.com/gitgitgadget/git/pull/1919
-- 
gitgitgadget