From 2d88ab078db03b6a608d30b8ef49cc7afb4b2f1c Mon Sep 17 00:00:00 2001 From: Han Young Date: Tue, 24 Feb 2026 14:13:29 +0800 Subject: diffcore-break: avoid segfault with freed entries After we have freed the file pair, we should set the queue reference to null. When computing a diff in a partial clone, there is a chance that we could trigger a prefetch of missing objects when there are freed entries in the global diff queue due to break-rewrites detection. The segfault only occurs if an entry has been freed by break-rewrites and there is an entry to be prefetched. There is a new test in t4067 that trigger the segmentation fault that results in this case. The test explicitly fetch the necessary blobs to trigger the break rewrites, some blobs are left to be prefetched. The fix is to set the queue pointer to NULL after it is freed, the prefetch will skip NULL entries. Signed-off-by: Han Young Signed-off-by: Junio C Hamano --- diffcore-break.c | 1 + 1 file changed, 1 insertion(+) (limited to 'diffcore-break.c') diff --git a/diffcore-break.c b/diffcore-break.c index c4c2173f30..9b11fe2fa0 100644 --- a/diffcore-break.c +++ b/diffcore-break.c @@ -222,6 +222,7 @@ void diffcore_break(struct repository *r, int break_score) free(p); /* not diff_free_filepair(), we are * reusing one and two here. */ + q->queue[i] = NULL; continue; } } -- cgit v1.3