1 file changed, 9 insertions, 13 deletions

diff --git a/source/ui-refs.c b/source/ui-refs.c
index 932ba6d..84b929c 100644
--- a/source/ui-refs.c
+++ b/source/ui-refs.c
@@ -27,14 +27,6 @@ static int cmp_ref_name(const void *a, const void *b)
 	return strcmp(r1->refname, r2->refname);
 }
 
-static int cmp_branch_age(const void *a, const void *b)
-{
-	struct refinfo *r1 = *(struct refinfo **)a;
-	struct refinfo *r2 = *(struct refinfo **)b;
-
-	return cmp_age(r1->commit->committer_date, r2->commit->committer_date);
-}
-
 static int get_ref_age(struct refinfo *ref)
 {
 	if (!ref->object)
@@ -48,7 +40,11 @@ static int get_ref_age(struct refinfo *ref)
 	return 0;
 }
 
-static int cmp_tag_age(const void *a, const void *b)
+// tag and commit share a union in struct refinfo and only the member matching
+// the object type is ever filled, so the date has to be reached through
+// get_ref_age rather than by assuming a branch points at a commit. Reading the
+// wrong member ran off the end of the smaller struct.
+static int cmp_ref_age(const void *a, const void *b)
 {
 	struct refinfo *r1 = *(struct refinfo **)a;
 	struct refinfo *r2 = *(struct refinfo **)b;
@@ -203,7 +199,7 @@ void cgit_print_branches(int maxcount)
 	if (maxcount == 0 || maxcount > list.count)
 		maxcount = list.count;
 
-	qsort(list.refs, list.count, sizeof(*list.refs), cmp_branch_age);
+	qsort(list.refs, list.count, sizeof(*list.refs), cmp_ref_age);
 	if (ctx.repo->branch_sort == 0)
 		qsort(list.refs, maxcount, sizeof(*list.refs), cmp_ref_name);
 
@@ -227,7 +223,7 @@ void cgit_print_tags(int maxcount)
 			      cgit_refs_cb, &list);
 	if (list.count == 0)
 		return;
-	qsort(list.refs, list.count, sizeof(*list.refs), cmp_tag_age);
+	qsort(list.refs, list.count, sizeof(*list.refs), cmp_ref_age);
 	if (!maxcount)
 		maxcount = list.count;
 	else if (maxcount > list.count)
@@ -253,7 +249,7 @@ static void print_branches_page(int pagesize)
 	print_branch_header();
 	collect_branches(&list);
 
-	qsort(list.refs, list.count, sizeof(*list.refs), cmp_branch_age);
+	qsort(list.refs, list.count, sizeof(*list.refs), cmp_ref_age);
 	if (ctx.repo->branch_sort == 0)
 		qsort(list.refs, list.count, sizeof(*list.refs), cmp_ref_name);
 
@@ -284,7 +280,7 @@ static void print_tags_page(int pagesize)
 			      cgit_refs_cb, &list);
 	if (list.count == 0)
 		return;
-	qsort(list.refs, list.count, sizeof(*list.refs), cmp_tag_age);
+	qsort(list.refs, list.count, sizeof(*list.refs), cmp_ref_age);
 
 	if (pagesize <= 0 || pagesize > list.count)
 		pagesize = list.count;