{"thread":{"id":"14122","subject":"Segmentation fault on http clone, post-1.5.6","startedAt":"2008-06-24T13:04:57Z","lastAt":"2008-06-24T21:56:00Z","messageCount":8,"participants":["Teemu Likonen","Jeff King","Nicolas Pitre","Mike Hommey","SZEDER Gábor"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"80890","messageId":"20080624130457.GB13696@mithlond.arda.local","threadId":"14122","inReplyTo":null,"subject":"Segmentation fault on http clone, post-1.5.6","fromName":"Teemu Likonen","fromEmail":"tlikonen@iki.fi","sentAt":"2008-06-24T13:04:57Z","receivedAt":"2008-06-24T13:04:57Z","isPatch":false,"sender":{"key":"tlikonen@iki.fi","avatar":null},"body":"With the current \"master\" branch version (29b0d0191) I get segmentation\nfault when trying to clone a git repo with http protocol. Tried a couple\nof times and it's always reproducible. You can test with the following\nrepository (about 5.5 MB):\n\n  git clone http://www.iki.fi/tlikonen/voikko.git\n\nI also build git from the tag v1.5.6 and it seems to work fine, so\nI guess the bug was introduced after 1.5.6.\n"},{"id":"80922","messageId":"20080624164034.GB4654@sigill.intra.peff.net","threadId":"14122","inReplyTo":"20080624130457.GB13696@mithlond.arda.local","subject":"Re: Segmentation fault on http clone, post-1.5.6","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2008-06-24T16:40:34Z","receivedAt":"2008-06-24T16:40:34Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Jun 24, 2008 at 04:04:57PM +0300, Teemu Likonen wrote:\n\n> With the current \"master\" branch version (29b0d0191) I get segmentation\n> fault when trying to clone a git repo with http protocol. Tried a couple\n> of times and it's always reproducible. You can test with the following\n> repository (about 5.5 MB):\n> \n>   git clone http://www.iki.fi/tlikonen/voikko.git\n\nI can't reproduce the segfault here.\n\n> I also build git from the tag v1.5.6 and it seems to work fine, so\n> I guess the bug was introduced after 1.5.6.\n\nThat sounds like an excellent opportunity to learn about git-bisect. Can\nyou try bisecting the bug and reporting back the problematic commit?\n\n-Peff\n"},{"id":"80945","messageId":"20080624185723.GA3368@mithlond.arda.local","threadId":"14122","inReplyTo":"20080624164034.GB4654@sigill.intra.peff.net","subject":"Re: Segmentation fault on http clone, post-1.5.6","fromName":"Teemu Likonen","fromEmail":"tlikonen@iki.fi","sentAt":"2008-06-24T18:57:23Z","receivedAt":"2008-06-24T18:57:23Z","isPatch":false,"sender":{"key":"tlikonen@iki.fi","avatar":null},"body":"Jeff King wrote (2008-06-24 12:40 -0400):\n\n> On Tue, Jun 24, 2008 at 04:04:57PM +0300, Teemu Likonen wrote:\n> \n> > With the current \"master\" branch version (29b0d0191) I get\n> > segmentation fault when trying to clone a git repo with http\n> > protocol. Tried a couple of times and it's always reproducible. You\n> > can test with the following repository (about 5.5 MB):\n> > \n> >   git clone http://www.iki.fi/tlikonen/voikko.git\n> \n> I can't reproduce the segfault here.\n> \n> > I also build git from the tag v1.5.6 and it seems to work fine, so\n> > I guess the bug was introduced after 1.5.6.\n> \n> That sounds like an excellent opportunity to learn about git-bisect.\n> Can you try bisecting the bug and reporting back the problematic\n> commit?\n\nIndeed. I have now officially bisected the problem and the first bad or\nproblematic commit is 8eca0b47 \"implement some resilience against pack\ncorruptions\" (hence Cc to Nicolas, the author). This is always\nreproducible in my Debian 4.0 box.\n"},{"id":"80964","messageId":"20080624193441.GC28574@glandium.org","threadId":"14122","inReplyTo":"20080624185723.GA3368@mithlond.arda.local","subject":"Re: Segmentation fault on http clone, post-1.5.6","fromName":"Mike Hommey","fromEmail":"mh@glandium.org","sentAt":"2008-06-24T19:34:41Z","receivedAt":"2008-06-24T19:34:41Z","isPatch":false,"sender":{"key":"mh@glandium.org","avatar":"https://avatars.githubusercontent.com/u/1038527?v=4"},"body":"On Tue, Jun 24, 2008 at 09:57:23PM +0300, Teemu Likonen wrote:\n> Jeff King wrote (2008-06-24 12:40 -0400):\n> \n> > On Tue, Jun 24, 2008 at 04:04:57PM +0300, Teemu Likonen wrote:\n> > \n> > > With the current \"master\" branch version (29b0d0191) I get\n> > > segmentation fault when trying to clone a git repo with http\n> > > protocol. Tried a couple of times and it's always reproducible. You\n> > > can test with the following repository (about 5.5 MB):\n> > > \n> > >   git clone http://www.iki.fi/tlikonen/voikko.git\n> > \n> > I can't reproduce the segfault here.\n> > \n> > > I also build git from the tag v1.5.6 and it seems to work fine, so\n> > > I guess the bug was introduced after 1.5.6.\n> > \n> > That sounds like an excellent opportunity to learn about git-bisect.\n> > Can you try bisecting the bug and reporting back the problematic\n> > commit?\n> \n> Indeed. I have now officially bisected the problem and the first bad or\n> problematic commit is 8eca0b47 \"implement some resilience against pack\n> corruptions\" (hence Cc to Nicolas, the author). This is always\n> reproducible in my Debian 4.0 box.\n\nDoes it crash in verify_packfile() ?\n\nMike\n"},{"id":"80963","messageId":"alpine.LFD.1.10.0806241524480.2979@xanadu.home","threadId":"14122","inReplyTo":"20080624185723.GA3368@mithlond.arda.local","subject":"Re: Segmentation fault on http clone, post-1.5.6","fromName":"Nicolas Pitre","fromEmail":"nico@cam.org","sentAt":"2008-06-24T19:34:45Z","receivedAt":"2008-06-24T19:34:45Z","isPatch":false,"sender":{"key":"nico@fluxnic.net","avatar":"https://avatars.githubusercontent.com/u/702790?v=4"},"body":"On Tue, 24 Jun 2008, Teemu Likonen wrote:\n\n> Jeff King wrote (2008-06-24 12:40 -0400):\n> \n> > On Tue, Jun 24, 2008 at 04:04:57PM +0300, Teemu Likonen wrote:\n> > \n> > > With the current \"master\" branch version (29b0d0191) I get\n> > > segmentation fault when trying to clone a git repo with http\n> > > protocol. Tried a couple of times and it's always reproducible. You\n> > > can test with the following repository (about 5.5 MB):\n> > > \n> > >   git clone http://www.iki.fi/tlikonen/voikko.git\n> > \n> > I can't reproduce the segfault here.\n> > \n> > > I also build git from the tag v1.5.6 and it seems to work fine, so\n> > > I guess the bug was introduced after 1.5.6.\n> > \n> > That sounds like an excellent opportunity to learn about git-bisect.\n> > Can you try bisecting the bug and reporting back the problematic\n> > commit?\n> \n> Indeed. I have now officially bisected the problem and the first bad or\n> problematic commit is 8eca0b47 \"implement some resilience against pack\n> corruptions\" (hence Cc to Nicolas, the author). This is always\n> reproducible in my Debian 4.0 box.\n\nI'm trying to reproduce your segfault with current master \n(v1.5.6-56-g29b0d01) but I just can't.\n\nCan you provide a gdb backtrace of the segfault?  What my patch does is \nto return NULL in all cases when an object exists but can't be read \ninstead of dying.  So if some user of read_sha1_file() is not checking \nfor a returned null pointer then a null pointer dereference is most \nlikely.\n\nNote that read_sha1_file() could have returned NULL even before my \npatch, but not necessarily in all cases.\n\n\nNicolas\n"},{"id":"80984","messageId":"20080624205556.GA3565@mithlond.arda.local","threadId":"14122","inReplyTo":"alpine.LFD.1.10.0806241524480.2979@xanadu.home","subject":"Re: Segmentation fault on http clone, post-1.5.6","fromName":"Teemu Likonen","fromEmail":"tlikonen@iki.fi","sentAt":"2008-06-24T20:55:56Z","receivedAt":"2008-06-24T20:55:56Z","isPatch":false,"sender":{"key":"tlikonen@iki.fi","avatar":null},"body":"Nicolas Pitre wrote (2008-06-24 15:34 -0400):\n\n> I'm trying to reproduce your segfault with current master\n> (v1.5.6-56-g29b0d01) but I just can't.\n> \n> Can you provide a gdb backtrace of the segfault?\n\nLet's hope I'm doing this right. Just installed gdb for the first time.\nI started with \"gdb git\" and then typed \"run clone http://...\".\nEventually it gave this:\n\n\nProgram received signal SIGSEGV, Segmentation fault.\n0x080cb69a in find_pack_entry (sha1=0x81675bc \"\\224�d�BX\\006�\\020��\\016�2\\214\\002\\n�R\", e=0xbfcccd18, ignore_packed=0x0) at cache.h:489\n489             return memcmp(sha1, sha2, 20);\n\n\nAnd \"bt\" command prints this:\n\n\n#0  0x080cb69a in find_pack_entry (sha1=0x81675bc \"\\224�d�BX\\006�\\020��\\016�2\\214\\002\\n�R\", e=0xbfcccd18, ignore_packed=0x0)\n    at cache.h:489\n#1  0x080cd05f in read_packed_sha1 (sha1=0x6900736b <Address 0x6900736b out of bounds>, type=0xbfccede4, size=0xbfccede8)\n    at sha1_file.c:1924\n#2  0x080cd211 in read_sha1_file (sha1=0x81675bc \"\\224�d�BX\\006�\\020��\\016�2\\214\\002\\n�R\", type=0xbfccede4, size=0xbfccede8)\n    at sha1_file.c:2016\n#3  0x080b468a in parse_object (sha1=0x81675bc \"\\224�d�BX\\006�\\020��\\016�2\\214\\002\\n�R\") at object.c:190\n#4  0x080d69bd in walker_fetch (walker=0x8147610, targets=89, target=0x8163270, write_ref=0x0, write_ref_log_details=0x0) at walker.c:182\n#5  0x080d16d1 in fetch_objs_via_curl (transport=0x81475e0, nr_objs=89, to_fetch=0x81630a0) at transport.c:369\n#6  0x080d0c57 in transport_fetch_refs (transport=0x81475e0, refs=0x8163020) at transport.c:814\n#7  0x0805be15 in cmd_clone (argc=2, argv=dwarf2_read_address: Corrupted DWARF expression.\n) at builtin-clone.c:465\n#8  0x0804b081 in handle_internal_command (argc=2, argv=0xbfcd1568) at git.c:252\n#9  0x0804b272 in main (argc=0, argv=0x8165240) at git.c:448\n"},{"id":"80990","messageId":"alpine.LFD.1.10.0806241720440.2979@xanadu.home","threadId":"14122","inReplyTo":"20080624205556.GA3565@mithlond.arda.local","subject":"Re: Segmentation fault on http clone, post-1.5.6","fromName":"Nicolas Pitre","fromEmail":"nico@cam.org","sentAt":"2008-06-24T21:24:49Z","receivedAt":"2008-06-24T21:24:49Z","isPatch":false,"sender":{"key":"nico@fluxnic.net","avatar":"https://avatars.githubusercontent.com/u/702790?v=4"},"body":"On Tue, 24 Jun 2008, Teemu Likonen wrote:\n\n> Nicolas Pitre wrote (2008-06-24 15:34 -0400):\n> \n> > I'm trying to reproduce your segfault with current master\n> > (v1.5.6-56-g29b0d01) but I just can't.\n> > \n> > Can you provide a gdb backtrace of the segfault?\n> \n> Let's hope I'm doing this right. Just installed gdb for the first time.\n> I started with \"gdb git\" and then typed \"run clone http://...\".\n> Eventually it gave this:\n\nExcellent!\n\nThe problem is probably fixed with this:\n\ndiff --git a/sha1_file.c b/sha1_file.c\nindex a92f023..b7d1a82 100644\n--- a/sha1_file.c\n+++ b/sha1_file.c\n@@ -844,6 +844,8 @@ struct packed_git *parse_pack_index(unsigned char *sha1)\n \n \tstrcpy(p->pack_name, path);\n \tp->pack_size = 0;\n+\tp->num_bad_objects = 0;\n+\tp->bad_object_sha1 = NULL;\n \tp->next = NULL;\n \tp->windows = NULL;\n \tp->pack_fd = -1;\n\nCould you confirm it?\n\nHowever I just don't like the fact that pack structures are allocated \nand initialized in two places, which makes it error prone as \ndemonstrated here.  So I'll cook up a better patch that fixes the \nduplication issue.\n\n\nNicolas\n"},{"id":"80993","messageId":"20080624215600.GJ8421@neumann","threadId":"14122","inReplyTo":"alpine.LFD.1.10.0806241720440.2979@xanadu.home","subject":"Re: Segmentation fault on http clone, post-1.5.6","fromName":"SZEDER Gábor","fromEmail":"szeder@ira.uka.de","sentAt":"2008-06-24T21:56:00Z","receivedAt":"2008-06-24T21:56:00Z","isPatch":false,"sender":{"key":"szeder.dev@gmail.com","avatar":"https://avatars.githubusercontent.com/u/116324?v=4"},"body":"Hi,\n\nOn Tue, Jun 24, 2008 at 05:24:49PM -0400, Nicolas Pitre wrote:\n> The problem is probably fixed with this:\n> \n> Could you confirm it?\nIt seems to fix the problem at me.\n\nGábor\n"}]}