1 files changed, 21 insertions, 9 deletions

diff --git a/src/revparse.c b/src/revparse.c
index c66a9852e..3f210d11b 100644
--- a/src/revparse.c
+++ b/src/revparse.c
@@ -323,10 +323,10 @@ static git_object* dereference_object(git_object *obj)
       break;
    case GIT_OBJ_TAG:
       {
-            git_object *newobj = NULL;
-            if (0 == git_tag_target(&newobj, (git_tag*)obj)) {
-               return newobj;
-            }
+         git_object *newobj = NULL;
+         if (0 == git_tag_target(&newobj, (git_tag*)obj)) {
+            return newobj;
+         }
       }
       break;
 
@@ -406,7 +406,7 @@ static int handle_caret_syntax(git_object **out, git_repository *repo, git_objec
          *out = newobj2;
          return 0;
       }
-      
+
       /* {/...} -> Walk all commits until we see a commit msg that matches the phrase. */
       if (movement[1] == '/') {
          int retcode = GIT_ERROR;
@@ -506,8 +506,8 @@ static int handle_linear_syntax(git_object **out, git_object *obj, const char *m
    /* "~" is the same as "~1" */
    if (*movement == '\0') {
       n = 1;
-   } else {
-      git__strtol32(&n, movement, NULL, 0);
+   } else if (git__strtol32(&n, movement, NULL, 0) < 0) {
+      return GIT_ERROR;
    }
    commit1 = (git_commit*)obj;
 
@@ -537,7 +537,7 @@ static int oid_for_tree_path(git_oid *out, git_tree *tree, git_repository *repo,
    char *tok;
    void *alloc = str;
    git_tree *tree2 = tree;
-   const git_tree_entry *entry;
+   const git_tree_entry *entry = NULL;
 
    while ((tok = git__strtok(&str, "/\\")) != NULL) {
       entry = git_tree_entry_byname(tree2, tok);
@@ -550,6 +550,12 @@ static int oid_for_tree_path(git_oid *out, git_tree *tree, git_repository *repo,
       }
    }
 
+   if (!entry) {
+      giterr_set(GITERR_INVALID, "Invalid tree path '%s'", path);
+      git__free(alloc);
+      return GIT_ERROR;
+   }
+
    git_oid_cpy(out, git_tree_entry_id(entry));
    git__free(alloc);
    return 0;
@@ -562,6 +568,7 @@ static int handle_colon_syntax(git_object **out,
 {
    git_tree *tree;
    git_oid oid;
+   int error;
 
    /* Dereference until we reach a tree. */
    if (dereference_to_type(&obj, obj, GIT_OBJ_TREE) < 0) {
@@ -570,8 +577,12 @@ static int handle_colon_syntax(git_object **out,
    tree = (git_tree*)obj;
 
    /* Find the blob at the given path. */
-   oid_for_tree_path(&oid, tree, repo, path);
+   error = oid_for_tree_path(&oid, tree, repo, path);
    git_tree_free(tree);
+
+   if (error < 0)
+      return error;
+
    return git_object_lookup(out, repo, &oid, GIT_OBJ_ANY);
 }
 
@@ -612,6 +623,7 @@ static int revparse_global_grep(git_object **out, git_repository *repo, const ch
          }
          if (!resultobj) {
             giterr_set(GITERR_REFERENCE, "Couldn't find a match for %s", pattern);
+            git_object_free(walkobj);
          } else {
             *out = resultobj;
          }