got_get_repo_commits mixes ids allocated on the heap and the one returned by the iter_next in the same variable, and then even attemp to free it. This is both a leak (we loose the pointer to the previously allocated id) and a possible invalid free since the object id pointer returned by the graph iterator is not to be passed to free(3). part of a bigger diff that's ok stsp@

ok stsp@

ok stsp@

ok stsp@

commit_id is not NULL if got_repo_match_object_id returned successfully. ok stsp@

ok stsp@

ok stsp@

in_repo_path was used only to build a path, it's then assigned to path (which is NULL at that point.) Just asprintf into path. ok stsp@

call got_get_repo_commit only once and avoid leaking the field of repo_commit at each loop iteration. ok stsp@

some code-paths may leak it. ok stsp@

it's still used a bit later, so defer the free'ing at the next loop iteration or at function end.

in case of a failure between when it's allocated and when it's released it might get leaked otherwise. ok and semplification stsp@

ok stsp@