From 753ecf42053b8afa9afcc19726635cc5a080c1bb Mon Sep 17 00:00:00 2001 From: Yuvraj Singh Chauhan Date: Fri, 20 Mar 2026 17:18:23 +0530 Subject: [PATCH] path-walk: fix NULL pointer dereference in error message When lookup_tree() or lookup_blob() cannot find a tree entry's object, 'o' is set to NULL via: o = child ? &child->object : NULL; The subsequent null-check catches this correctly, but then dereferences 'o' to format the error message: error(_("failed to find object %s"), oid_to_hex(&o->oid)); This causes a segfault instead of the intended diagnostic output. Fix this by using &entry.oid instead. 'entry' is the struct name_entry populated by tree_entry() on each loop iteration and holds the OID of the failing lookup -- which is exactly what the error should report. This crash is reachable via git-backfill(1) when a tree entry's object is absent from the local object database. Signed-off-by: Yuvraj Singh Chauhan Signed-off-by: Junio C Hamano --- path-walk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/path-walk.c b/path-walk.c index f1ceed99e9..dd2c138c98 100644 --- a/path-walk.c +++ b/path-walk.c @@ -171,7 +171,7 @@ static int add_tree_entries(struct path_walk_context *ctx, if (!o) { error(_("failed to find object %s"), - oid_to_hex(&o->oid)); + oid_to_hex(&entry.oid)); return -1; }