commit 1a85cdc0cdad4108e1a13fda41a8b441af86c05d
from: Renato Aguiar <renato@renatoaguiar.net>
via: Thomas Adam <thomas@xteddy.org>
date: Fri Jun 27 06:52:35 2025 UTC

fix segfault due to double-free in got-read-gotconfig

Could be triggered by running 'got fetch' with a "send" block in got.conf.

The functions free_fetch_config() and free_send_config() were freeing data
via the global "remote" variable instead of their own argument as intended.

Patch by Renato Aguiar

commit - e49415b630418c006b4b37191530f44f4a7b5d84
commit + 1a85cdc0cdad4108e1a13fda41a8b441af86c05d
blob - 081c519fdcfb2ad018a4a0b2f954a5bbe6571115
blob + 177c980e6bab339d0e740cdfb5f2937ddb5a8842
--- libexec/got-read-gotconfig/parse.y
+++ libexec/got-read-gotconfig/parse.y
@@ -797,19 +797,19 @@ gotconfig_parse(struct gotconfig **conf, const char *f
 static void
 free_fetch_config(struct fetch_config *fetch_config)
 {
-	free(remote->fetch_config->repository);
-	free(remote->fetch_config->server);
-	free(remote->fetch_config->protocol);
-	free(remote->fetch_config);
+	free(fetch_config->repository);
+	free(fetch_config->server);
+	free(fetch_config->protocol);
+	free(fetch_config);
 }
 
 static void
 free_send_config(struct send_config *send_config)
 {
-	free(remote->send_config->repository);
-	free(remote->send_config->server);
-	free(remote->send_config->protocol);
-	free(remote->send_config);
+	free(send_config->repository);
+	free(send_config->server);
+	free(send_config->protocol);
+	free(send_config);
 }
 
 void