)]}'
{
  "commit": "cfd52a74a0cf1a9b0e0ef6b480a45b119d8be4a2",
  "tree": "ebf59655b2e1f8a8c68d772b64f6e2276b089324",
  "parents": [
    "94f057755b7941b321fd11fec1b2e3ca5313a4e0"
  ],
  "author": {
    "name": "Patrick Steinhardt",
    "email": "ps@pks.im",
    "time": "Fri Jul 10 16:54:16 2026 +0200"
  },
  "committer": {
    "name": "Junio C Hamano",
    "email": "gitster@pobox.com",
    "time": "Fri Jul 10 14:20:53 2026 -0700"
  },
  "message": "object-file: fix closing object stream twice\n\nIn 10a6762719 (object-file: adapt `stream_object_signature()` to take a\nstream, 2026-02-23), we have refactored `stream_object_signature()` so\nthat it doesn\u0027t create the stream ad-hoc anymore. Instead, callers are\nexpected to pass in a stream, which allows them to construct the streams\nfrom different sources.\n\nWhile the stream was previously managed by `stream_object_signature()`,\nthe full lifecycle is now owned by the caller. Hence, it\u0027s the caller\u0027s\nresponsibility to close the stream, and the called function shouldn\u0027t do\nthat anymore.\n\nAnd while the mentioned commit did drop one call that closed the stream,\nthere\u0027s a second such call that was missed when reading from the stream\nfails. The consequence of this can be a double free of the stream.\n\nFix the bug by dropping that leftover call to `odb_read_stream_close()`.\n\nNote that it was originally discussed whether this should be treated as\na security vulnerability. But there are only two callers: once via\n`parse_object_with_flags()`, and once via `verify_packfile()`. Neither\nof these callers plays any role on the transport layer, so this issue is\nonly relevant for objects that are already available via the local\nobject database. Furthermore, a packfile that is corrupted in this way\nwould be detected when receiving the packfile, so it\u0027s not easy for an\nadversary to plant such a packfile, either. Consequently, we decided\nthat this is not covered as part of our threat model.\n\nReported-by: xuqing yang \u003crigelyoung@icloud.com\u003e\nHelped-by: Jeff King \u003cpeff@peff.net\u003e\nSigned-off-by: Patrick Steinhardt \u003cps@pks.im\u003e\nSigned-off-by: Junio C Hamano \u003cgitster@pobox.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "2acc9522df2daa8c3b0155dc9ed410a722e4c855",
      "old_mode": 33188,
      "old_path": "object-file.c",
      "new_id": "610faba5b699bf5f32e4a2b6d7f184bbfdc9fb19",
      "new_mode": 33188,
      "new_path": "object-file.c"
    },
    {
      "type": "modify",
      "old_id": "54e81c263686de387a6cfc73ca562d4d1ebeb5ae",
      "old_mode": 33261,
      "old_path": "t/t1450-fsck.sh",
      "new_id": "bc326a78f6f810b58ee57911e872f24f1e2e88c2",
      "new_mode": 33261,
      "new_path": "t/t1450-fsck.sh"
    }
  ]
}