{"thread":{"id":"10467","subject":"git-fast-import segfaults","startedAt":"2007-10-26T00:29:01Z","lastAt":"2007-10-29T06:29:37Z","messageCount":7,"participants":["cpettitt","Shawn O. Pearce","Pierre Habouzit","Shun Kei Leung"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"57252","messageId":"de47e4420710251729j5858481cg69146385a2ed798d@mail.gmail.com","threadId":"10467","inReplyTo":"de47e4420710251726nb45a19fk15b3105b735a74f8@mail.gmail.com","subject":"git-fast-import segfaults","fromName":"cpettitt","fromEmail":"cpettitt@gmail.com","sentAt":"2007-10-26T00:29:01Z","receivedAt":"2007-10-26T00:29:01Z","isPatch":false,"sender":{"key":"cpettitt@gmail.com","avatar":null},"body":"I'm seeing the following errors when I run git-fast-import (on Intel\nOSX) with some data from a git-p4 import:\n\n[cpettitt@gish scratch2]$ rm -rf .git; git init; git-fast-import < ~/writer.out\nInitialized empty Git repository in .git/\ngit-fast-import(23021) malloc: *** error for object 0x500e50: double free\ngit-fast-import(23021) malloc: *** set a breakpoint in szone_error to debug\ngit-fast-import(23021) malloc: *** Deallocation of a pointer not\nmalloced: 0x501a80; This could be a double free(), or free() called\nwith the middle of an allocated block; Try setting environment\nvariable MallocHelp to see tools to help debug\ngit-fast-import(23021) malloc: *** error for object 0x5020a0: double free\ngit-fast-import(23021) malloc: *** set a breakpoint in szone_error to debug\ngit-fast-import(23021) malloc: *** Deallocation of a pointer not\nmalloced: 0x5007e0; This could be a double free(), or free() called\nwith the middle of an allocated block; Try setting environment\nvariable MallocHelp to see tools to help debug\ngit-fast-import(23021) malloc: *** Deallocation of a pointer not\nmalloced: 0x5006e0; This could be a double free(), or free() called\nwith the middle of an allocated block; Try setting environment\nvariable MallocHelp to see tools to help debug\ngit-fast-import(23021) malloc: *** Deallocation of a pointer not\nmalloced: 0x501e10; This could be a double free(), or free() called\nwith the middle of an allocated block; Try setting environment\nvariable MallocHelp to see tools to help debug\ngit-fast-import(23021) malloc: *** Deallocation of a pointer not\nmalloced: 0x502190; This could be a double free(), or free() called\nwith the middle of an allocated block; Try setting environment\nvariable MallocHelp to see tools to help debug\ngit-fast-import(23021) malloc: *** error for object 0x500280: double free\ngit-fast-import(23021) malloc: *** set a breakpoint in szone_error to debug\ngit-fast-import(23021) malloc: *** Deallocation of a pointer not\nmalloced: 0x5009c0; This could be a double free(), or free() called\nwith the middle of an allocated block; Try setting environment\nvariable MallocHelp to see tools to help debug\ngit-fast-import(23021) malloc: *** error for object 0x500b00:\nincorrect checksum for freed object - object was probably modified\nafter being freed, break at szone_error to debug\ngit-fast-import(23021) malloc: *** set a breakpoint in szone_error to debug\nSegmentation fault\n\nI start getting free errors at fast-import.c:1577:\n\n rc = rc_free;\n if (rc)\n rc_free = rc->next;\n else {\n rc = cmd_hist.next;\n cmd_hist.next = rc->next;\n cmd_hist.next->prev = &cmd_hist;\n free(rc->buf); // <-- error is emitted\nin free here\n }\n\n\nI believe these errors started showing up in commit\nb449f4cfc972929b638b90d375b8960c37790618. I did a bisect on\nfast-import.c and this was the first commit for that file that\nexhibits this bug with the input.\n\nI thought I would check with the list to see if this is a known issue\nbefore I spend time trying to dig into it.\n"},{"id":"57259","messageId":"20071026065301.GL14735@spearce.org","threadId":"10467","inReplyTo":"de47e4420710251729j5858481cg69146385a2ed798d@mail.gmail.com","subject":"Re: git-fast-import segfaults","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2007-10-26T06:53:01Z","receivedAt":"2007-10-26T06:53:01Z","isPatch":false,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"cpettitt wrote:\n> I'm seeing the following errors when I run git-fast-import (on Intel\n> OSX) with some data from a git-p4 import:\n...\n> I believe these errors started showing up in commit\n> b449f4cfc972929b638b90d375b8960c37790618. I did a bisect on\n> fast-import.c and this was the first commit for that file that\n> exhibits this bug with the input.\n> \n> I thought I would check with the list to see if this is a known issue\n> before I spend time trying to dig into it.\n\nIt is a known issue. Someone else has reported the same thing,\nand bisecting pointed at the same commit. But they weren't able\nto supply their input data for debugging by Pierre or myself as it\nwas a private project and they haven't had a chance to attempt to\ndebug it on their own.\n\nAny light you can shed on the problem would be most appreciated.\n\n-- \nShawn.\n"},{"id":"57265","messageId":"20071026075912.GA25365@artemis.corp","threadId":"10467","inReplyTo":"20071026065301.GL14735@spearce.org","subject":"[PATCH] Fix regression in fast-import.c due to strbufs.","fromName":"Pierre Habouzit","fromEmail":"madcoder@debian.org","sentAt":"2007-10-26T07:59:12Z","receivedAt":"2007-10-26T07:59:12Z","isPatch":true,"sender":{"key":"madcoder@debian.org","avatar":"https://avatars.githubusercontent.com/u/44708?v=4"},"body":"Without this strbuf_release, it yields a double free later, the command is\nin fact stashed, and this is not a memory leak.\n\nSigned-off-by: Pierre Habouzit \n---\n\n On Fri, Oct 26, 2007 at 06:53:01AM +0000, Shawn O. Pearce wrote:\n > cpettitt wrote:\n > > I'm seeing the following errors when I run git-fast-import (on Intel\n > > OSX) with some data from a git-p4 import:\n > ....\n > > I believe these errors started showing up in commit\n > > b449f4cfc972929b638b90d375b8960c37790618. I did a bisect on\n > > fast-import.c and this was the first commit for that file that\n > > exhibits this bug with the input.\n > > \n > > I thought I would check with the list to see if this is a known issue\n > > before I spend time trying to dig into it.\n > \n > It is a known issue. Someone else has reported the same thing,\n > and bisecting pointed at the same commit. But they weren't able\n > to supply their input data for debugging by Pierre or myself as it\n > was a private project and they haven't had a chance to attempt to\n > debug it on their own.\n > \n > Any light you can shed on the problem would be most appreciated.\n\n Wait, I believe I found the problem thanks to the \"free\" that fails.\n\n Could you please try that patch ? looking at the diff again, and\n knowing the issue is with an rc->buf (which are old command_buf\n stashed buffers) it looks like I migrated cmd_data improperly.\n\n-- \n·O· Pierre Habouzit\n··O madcoder@debian.org\nOOO http://www.madism.org\n fast-import.c | 1 +\n 1 files changed, 1 insertions(+), 0 deletions(-)\n\ndiff --git a/fast-import.c b/fast-import.c\nindex 6f888f6..f93d7d6 100644\n--- a/fast-import.c\n+++ b/fast-import.c\n@@ -1616,6 +1616,7 @@ static void cmd_data(struct strbuf *sb)\n \t\tchar *term = xstrdup(command_buf.buf + 5 + 2);\n \t\tsize_t term_len = command_buf.len - 5 - 2;\n \n+\t\tstrbuf_detach(&command_buf, NULL);\n \t\tfor (;;) {\n \t\t\tif (strbuf_getline(&command_buf, stdin, '\\n') == EOF)\n \t\t\t\tdie(\"EOF in data (terminator '%s' not found)\", term);\n-- \n1.5.3.4.1358.gfae55-dirty\n\n"},{"id":"57289","messageId":"de47e4420710260939h65fbf62dg8d1644a5cd879c23@mail.gmail.com","threadId":"10467","inReplyTo":"20071026075912.GA25365@artemis.corp","subject":"Re: [PATCH] Fix regression in fast-import.c due to strbufs.","fromName":"cpettitt","fromEmail":"cpettitt@gmail.com","sentAt":"2007-10-26T16:39:27Z","receivedAt":"2007-10-26T16:39:27Z","isPatch":true,"sender":{"key":"cpettitt@gmail.com","avatar":null},"body":"On 10/26/07, Pierre Habouzit wrote:\n> Without this strbuf_release, it yields a double free later, the command is\n> in fact stashed, and this is not a memory leak.\n>\n> Signed-off-by: Pierre Habouzit \n\nPierre,\n\nYou nailed it! No more double frees and no segfault.\n\nThanks,\nChris\n"},{"id":"57297","messageId":"20071026172523.GB5496@artemis.corp","threadId":"10467","inReplyTo":"20071026075912.GA25365@artemis.corp","subject":"Re: [PATCH] Fix regression in fast-import.c due to strbufs.","fromName":"Pierre Habouzit","fromEmail":"madcoder@debian.org","sentAt":"2007-10-26T17:25:23Z","receivedAt":"2007-10-26T17:25:23Z","isPatch":true,"sender":{"key":"madcoder@debian.org","avatar":"https://avatars.githubusercontent.com/u/44708?v=4"},"body":"Dear Shun, the fast-import bug your reported has a fix.\n\nDear Junio, please merge the patch in the mail I'm answering to[0] into\nmaster as it fixes a crash in fast-import.\n\nCheers,\n\n [0] Message-Id: <20071026075912.GA25365@artemis.corp>\n\ndiff --git a/fast-import.c b/fast-import.c\nindex 6f888f6..f93d7d6 100644\n--- a/fast-import.c\n+++ b/fast-import.c\n@@ -1616,6 +1616,7 @@ static void cmd_data(struct strbuf *sb)\n \t\tchar *term = xstrdup(command_buf.buf + 5 + 2);\n \t\tsize_t term_len = command_buf.len - 5 - 2;\n \n+\t\tstrbuf_detach(&command_buf, NULL);\n \t\tfor (;;) {\n \t\t\tif (strbuf_getline(&command_buf, stdin, '\\n') == EOF)\n \t\t\t\tdie(\"EOF in data (terminator '%s' not found)\", term);\n-- \n1.5.3.4.1358.gfae55-dirty\n\n\n\n\n-- \n·O· Pierre Habouzit\n··O madcoder@debian.org\nOOO http://www.madism.org\n"},{"id":"57459","messageId":"e66701d40710281959q517eabecm87bcf54c7fe47741@mail.gmail.com","threadId":"10467","inReplyTo":"20071026172523.GB5496@artemis.corp","subject":"Re: [PATCH] Fix regression in fast-import.c due to strbufs.","fromName":"Shun Kei Leung","fromEmail":"kevinlsk@gmail.com","sentAt":"2007-10-29T02:59:02Z","receivedAt":"2007-10-29T02:59:02Z","isPatch":true,"sender":{"key":"kevinlsk@gmail.com","avatar":null},"body":"Hi Pierre,\n\nThanks. You are the man! It works perfectly now.\n\nRegards,\nKevin\n"},{"id":"57466","messageId":"20071029062937.GB15520@artemis.corp","threadId":"10467","inReplyTo":"e66701d40710281959q517eabecm87bcf54c7fe47741@mail.gmail.com","subject":"Re: [PATCH] Fix regression in fast-import.c due to strbufs.","fromName":"Pierre Habouzit","fromEmail":"madcoder@debian.org","sentAt":"2007-10-29T06:29:37Z","receivedAt":"2007-10-29T06:29:37Z","isPatch":true,"sender":{"key":"madcoder@debian.org","avatar":"https://avatars.githubusercontent.com/u/44708?v=4"},"body":"On Mon, Oct 29, 2007 at 02:59:02AM +0000, Shun Kei Leung wrote:\n> Hi Pierre,\n> \n> Thanks. You are the man! It works perfectly now.\n\n Actually, I also was the one breaking it in the first place, but\nyou're welcome :)\n\n-- \n·O· Pierre Habouzit\n··O madcoder@debian.org\nOOO http://www.madism.org\n"}]}