commit 3a4790b63c064d57bc9a61ebeb2dc145d6468f53
from: Stefan Sperling <stsp@stsp.name>
via: Thomas Adam <thomas@xteddy.org>
date: Tue Mar 22 17:54:12 2022 UTC

fix potential NULL deref in error path of got_object_idset_remove()

commit - be53ddb1cf400566466802853561b948acaa613e
commit + 3a4790b63c064d57bc9a61ebeb2dc145d6468f53
blob - e99cc4f4653bb6dc0b6694b5dfe9cadd50d7c7cc
blob + 0756600c6c7bca294f7a50bfa99260c2474ee20e
--- lib/object_idset.c
+++ lib/object_idset.c
@@ -144,12 +144,15 @@ got_object_idset_remove(void **data, struct got_object
 	if (set->totelem == 0)
 		return got_error(GOT_ERR_NO_OBJ);
 
-	if (id == NULL)
+	if (id == NULL) {
 		entry = RB_ROOT(&set->entries);
-	else
+		if (entry == NULL)
+			return got_error(GOT_ERR_NO_OBJ);
+	} else {
 		entry = find_element(set, id);
-	if (entry == NULL)
-		return got_error_no_obj(id);
+		if (entry == NULL)
+			return got_error_no_obj(id);
+	}
 
 	RB_REMOVE(got_object_idset_tree, &set->entries, entry);
 	if (data)