Fix refcounting bugs in the refdb backend write callback

pygit2_refdb_backend_write() passed owned objects to Py_BuildValue() with the N format, which takes ownership, then decref'd the same objects again in the shared cleanup block — a double DECREF that can lead to use-after-free. It also passed a borrowed reference to the Py_True/Py_False singleton with N, and the error path called Py_DECREF() on possibly NULL pointers. Restructure the function with early returns so each failure point releases exactly the objects it owns, and pass a new reference for the force flag via PyBool_FromLong(). Fixes Product Launch Icon Red Assisted-by: Kimi Code

Author: Student Get To Know You Worksheet

src/refdb_backend.c

@@ -210,33 +210,38 @@ pygit2_refdb_backend_write(git_refdb_backend *_be,
  const git_signature *_who, const char *message,
  const git_oid *_old, const char *old_target)
 {
- int err;
- PyObject *args = NULL, *ref = NULL, *who = NULL, *old = NULL;
  struct pygit2_refdb_backend *be = (struct pygit2_refdb_backend *)_be;
 
- // XXX: Drops const
- if ((ref = wrap_reference((git_reference *)_ref, NULL)) == NULL)
- goto euser;
- if ((who = build_signature(NULL, _who, "utf-8")) == NULL)
- goto euser;
- if ((old = git_oid_to_python(_old)) == NULL)
- goto euser;
- if ((args = Py_BuildValue("(NNNsNs)", ref,
- force ? Py_True : Py_False,
- who, message, old, old_target)) == NULL)
- goto euser;
+ PyObject *ref = wrap_reference((git_reference *)_ref, NULL); // XXX: Drops const
+ if (ref == NULL) {
+ return GIT_EUSER;
+ }
+
+ PyObject *who = build_signature(NULL, _who, "utf-8");
+ if (who == NULL) {
+ Py_DECREF(ref);
+ return GIT_EUSER;
+ }
+
+ PyObject *old = git_oid_to_python(_old);
+ if (old == NULL) {
+ Py_DECREF(ref);
+ Py_DECREF(who);
+ return GIT_EUSER;
+ }
+
+ // Py_BuildValue takes ownership of ref, who and old (N format), even on failure, so
+ // they must not be decref'd past this point.
+ PyObject *args = Py_BuildValue("(NNNsNs)", ref, PyBool_FromLong(force), who, message,
+ old, old_target);
+ if (args == NULL) {
+ return GIT_EUSER;
+ }
 
  PyObject_CallObject(be->write, args);
- err = git_error_for_exc();
-out:
- Py_DECREF(ref);
- Py_DECREF(who);
- Py_DECREF(old);
+ int err = git_error_for_exc();
  Py_DECREF(args);
  return err;
-euser:
- err = GIT_EUSER;
- goto out;
 }
 
 static int