commit 696b1a9d2a13d33de9e3d182e3ec8fd3818f8b58
from: Mark Jamsek <mark@jamsek.dev>
via: Thomas Adam <thomas@xteddy.org>
date: Fri Jan  3 10:46:48 2025 UTC

tog: plug object id leak in resolve_reflist_entry error path

ok stsp@

commit - 6f001a132a5219599bd2cde4fea1957878cca26b
commit + 696b1a9d2a13d33de9e3d182e3ec8fd3818f8b58
blob - 3512ab341118eeaffa45969a14846501ab8387b2
blob + 79ff1430b9c3aafc77b7601269f359c9499e543b
--- tog/tog.c
+++ tog/tog.c
@@ -10056,13 +10056,11 @@ resolve_reflist_entry(struct got_object_id **commit_id
 
 	switch (obj_type) {
 	case GOT_OBJ_TYPE_COMMIT:
-		*commit_id = obj_id;
 		break;
 	case GOT_OBJ_TYPE_TAG:
 		err = got_object_open_as_tag(&tag, repo, obj_id);
 		if (err)
 			goto done;
-		free(obj_id);
 		err = got_object_get_type(&obj_type, repo,
 		    got_object_tag_get_object_id(tag));
 		if (err)
@@ -10071,9 +10069,9 @@ resolve_reflist_entry(struct got_object_id **commit_id
 			err = got_error(GOT_ERR_OBJ_TYPE);
 			goto done;
 		}
-		*commit_id = got_object_id_dup(
-		    got_object_tag_get_object_id(tag));
-		if (*commit_id == NULL) {
+		free(obj_id);
+		obj_id = got_object_id_dup(got_object_tag_get_object_id(tag));
+		if (obj_id == NULL) {
 			err = got_error_from_errno("got_object_id_dup");
 			goto done;
 		}
@@ -10086,10 +10084,10 @@ resolve_reflist_entry(struct got_object_id **commit_id
 done:
 	if (tag)
 		got_object_tag_close(tag);
-	if (err) {
-		free(*commit_id);
-		*commit_id = NULL;
-	}
+	if (err == NULL)
+		*commit_id = obj_id;
+	else
+		free(obj_id);
 	return err;
 }