commit - 2d9874c22b16a541dd8300cf257123c5aaf88e5e
commit + 079a296c54f560fb82144704231757db030e9b03
blob - 1e9bf9d8ca59c38661286e87f5efd24e2e8f3a47
blob + af6ba7a1760574543b9df659344ad68b725efd2d
--- gotd/session.c
+++ gotd/session.c
@@ -432,7 +432,9 @@ update_ref(int *shut, struct gotd_session_client *clie
 	if (err)
 		goto done;
 
+	memset(&old_id, 0, sizeof(old_id));
 	memcpy(old_id.hash, iref.old_id, SHA1_DIGEST_LENGTH);
+	memset(&new_id, 0, sizeof(new_id));
 	memcpy(new_id.hash, iref.new_id, SHA1_DIGEST_LENGTH);
 	err = got_object_open(&obj, repo,
 	    iref.delete_ref ? &old_id : &new_id);
blob - f12227a87fbf29ca50b94510c24cd6e56bb0c966
blob + 1cbdcdbea354c0a9b2e1165afd141e5c9083d258
--- lib/object_parse.c
+++ lib/object_parse.c
@@ -85,7 +85,7 @@ got_object_id_cmp(const struct got_object_id *id1,
 const struct got_error *
 got_object_qid_alloc_partial(struct got_object_qid **qid)
 {
-	*qid = malloc(sizeof(**qid));
+	*qid = calloc(1, sizeof(**qid));
 	if (*qid == NULL)
 		return got_error_from_errno("malloc");
 
blob - fad24a1058351eb3d8093ed6c825dea578d07d18
blob + 8f78e8b10321ed161ab6578ceb6672c339db36a0
--- lib/pack.c
+++ lib/pack.c
@@ -1122,6 +1122,11 @@ const struct got_error *
 got_pack_parse_ref_delta(struct got_object_id *id,
     struct got_pack *pack, off_t delta_offset, int tslen)
 {
+	size_t idlen;
+
+	idlen = got_hash_digest_length(pack->algo);
+	memset(id, 0, sizeof(*id));
+
 	if (pack->map) {
 		size_t mapoff;
 
@@ -1132,12 +1137,12 @@ got_pack_parse_ref_delta(struct got_object_id *id,
 		}
 
 		mapoff = delta_offset + tslen;
-		if (mapoff + sizeof(*id) >= pack->filesize)
+		if (mapoff + idlen >= pack->filesize)
 			return got_error(GOT_ERR_PACK_OFFSET);
-		memcpy(id, pack->map + mapoff, sizeof(*id));
+		memcpy(id->hash, pack->map + mapoff, idlen);
 	} else {
 		ssize_t n;
-		n = read(pack->fd, id, sizeof(*id));
+		n = read(pack->fd, id->hash, idlen);
 		if (n < 0)
 			return got_error_from_errno("read");
 		if (n != sizeof(*id))
blob - 4ea3be08309929c3ea1c63fe2e2331de3224a8a2
blob + cb6ced5b8cf9a2f978695a578452ca1a6210f0f8
--- lib/privsep.c
+++ lib/privsep.c
@@ -930,7 +930,7 @@ got_privsep_recv_send_remote_refs(struct got_pathlist_
 				err = got_error(GOT_ERR_PRIVSEP_MSG);
 				goto done;
 			}
-			id = malloc(sizeof(*id));
+			id = calloc(1, sizeof(*id));
 			if (id == NULL) {
 				err = got_error_from_errno("malloc");
 				goto done;
@@ -2879,6 +2879,7 @@ got_privsep_recv_enumerated_objects(int *found_all_obj
 				break;
 			}
 			icommit = (struct got_imsg_enumerated_commit *)imsg.data;
+			memset(&commit_id, 0, sizeof(commit_id));
 			memcpy(commit_id.hash, icommit->id, SHA1_DIGEST_LENGTH);
 			mtime = icommit->mtime;
 			have_commit = 1;
@@ -2899,6 +2900,7 @@ got_privsep_recv_enumerated_objects(int *found_all_obj
 				err = got_error(GOT_ERR_PRIVSEP_LEN);
 				break;
 			}
+			memset(&tree_id, 0, sizeof(tree_id));
 			memcpy(tree_id.hash, itree->id, sizeof(tree_id.hash));
 			free(path);
 			path = strndup(imsg.data + sizeof(*itree), path_len);
@@ -3516,6 +3518,8 @@ got_privsep_recv_painted_commits(struct got_object_id_
 
 			if (icommits.present_in_pack) {
 				struct got_object_id id;
+
+				memset(&id, 0, sizeof(id));
 				memcpy(id.hash, icommit.id, SHA1_DIGEST_LENGTH);
 				err = cb(cb_arg, &id, icommit.color);
 				if (err)
blob - b91b6d154554c6405825c3c00d9f73af2fab6126
blob + 5ad6e2fe0b60ca410804681d2b5ea45fdb93c4d2
--- lib/repository.c
+++ lib/repository.c
@@ -1779,6 +1779,9 @@ match_loose_object(struct got_object_id **unique_id, c
 			goto done;
 		}
 
+		
+		memset(&id, 0, sizeof(id));
+		id.algo = repo->algo;
 		if (!got_parse_hash_digest(id.hash, id_str, repo->algo))
 			continue;
 
blob - 719ece083358fc07f5c3c5071dde8e88a1ababff
blob + c58c4fe44da605cb0d46618f269c572599aa09b5
--- lib/repository_admin.c
+++ lib/repository_admin.c
@@ -571,6 +571,7 @@ got_repo_list_pack(FILE *packfile, struct got_object_i
 				break;
 		}
 		oid = packidx->hdr.sorted_ids + i * SHA1_DIGEST_LENGTH;
+		memset(&id, 0, sizeof(id));
 		memcpy(id.hash, oid->hash, SHA1_DIGEST_LENGTH);
 
 		offset = got_packidx_get_object_offset(packidx, i);
blob - d3c13c2f14fc04f87f98c38edf0cbfbc5ef5705e
blob + 66ab28ef7943fa60e5850fb0ece295e556c25239
--- libexec/got-read-pack/got-read-pack.c
+++ libexec/got-read-pack/got-read-pack.c
@@ -747,6 +747,7 @@ commit_traversal_request(struct imsg *imsg, struct ims
 		}
 
 		if (!changed) {
+			memset(&id, 0, sizeof(id));
 			memcpy(id.hash, pid->id.hash, SHA1_DIGEST_LENGTH);
 			got_object_commit_close(commit);
 			commit = pcommit;
@@ -1795,11 +1796,14 @@ commit_painting_request(struct imsg *imsg, struct imsg
 	int nids = 0;
 
 	STAILQ_INIT(&ids);
+	memset(&id, 0, sizeof(id));
 
 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
 	if (datalen != sizeof(ireq))
 		return got_error(GOT_ERR_PRIVSEP_LEN);
 	memcpy(&ireq, imsg->data, sizeof(ireq));
+
+	memset(&id, 0, sizeof(id));
 	memcpy(id.hash, ireq.id, SHA1_DIGEST_LENGTH);
 
 	err = queue_commit_id(&ids, &id, ireq.color);
blob - baca0291979ba2ef5ff6c55f19704c125b04cfb0
blob + b3e93066994db883668e4fb245e083be3007ab08
--- libexec/got-send-pack/got-send-pack.c
+++ libexec/got-send-pack/got-send-pack.c
@@ -409,7 +409,7 @@ send_pack(int fd, struct got_pathlist_head *refs,
 			continue;
 		}
 
-		id = malloc(sizeof(*id));
+		id = calloc(1, sizeof(*id));
 		if (id == NULL) {
 			err = got_error_from_errno("malloc");
 			goto done;