commit 62994af7ea42c1c4572bf7d55a6b30a00e9e81dc
from: Renato Aguiar <renato@renatoaguiar.net>
via: Stefan Sperling <stsp@stsp.name>
date: Fri Jun 27 06:42:07 2025 UTC

fix segfault due to double-free in got-read-gotconfig

Could be triggered by running 'got fetch' with a "send" block in got.conf.

The functions free_fetch_config() and free_send_config() were freeing data
via the global "remote" variable instead of their own argument as intended.

Patch by Renato Aguiar

commit - 1d26dbd4b176e993c088a1b058223d613ef9365c
commit + 62994af7ea42c1c4572bf7d55a6b30a00e9e81dc
blob - cf5be7e73168496c2b26cde6b459a1167864c846
blob + 65690c46bfc5b9e963118a30608cd70495f870c9
--- libexec/got-read-gotconfig/parse.y
+++ libexec/got-read-gotconfig/parse.y
@@ -791,19 +791,19 @@ gotconfig_parse(struct gotconfig **conf, const char *f
 static void
 free_fetch_config(struct fetch_config *fetch_config)
 {
-	free(remote->fetch_config->repository);
-	free(remote->fetch_config->server);
-	free(remote->fetch_config->protocol);
-	free(remote->fetch_config);
+	free(fetch_config->repository);
+	free(fetch_config->server);
+	free(fetch_config->protocol);
+	free(fetch_config);
 }
 
 static void
 free_send_config(struct send_config *send_config)
 {
-	free(remote->send_config->repository);
-	free(remote->send_config->server);
-	free(remote->send_config->protocol);
-	free(remote->send_config);
+	free(send_config->repository);
+	free(send_config->server);
+	free(send_config->protocol);
+	free(send_config);
 }
 
 void