{"thread":{"id":"38490","subject":"use-after-free leads to git-blame writing garbage in error message","startedAt":"2015-02-03T09:17:15Z","lastAt":"2015-02-03T09:38:43Z","messageCount":3,"participants":["Mike Hommey","Lukas Fleischer"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"255567","messageId":"20150203091715.GA25445@glandium.org","threadId":"38490","inReplyTo":null,"subject":"use-after-free leads to git-blame writing garbage in error message","fromName":"Mike Hommey","fromEmail":"mh@glandium.org","sentAt":"2015-02-03T09:17:15Z","receivedAt":"2015-02-03T09:17:15Z","isPatch":false,"sender":{"key":"mh@glandium.org","avatar":"https://avatars.githubusercontent.com/u/1038527?v=4"},"body":"Symptoms:\n  $ git blame HEAD -- foo\n  fatal: no such path foo in <random garbage>\n\nExpected output:\n  $ git blame HEAD -- foo\n  fatal: no such path foo in HEAD\n\nBisect says this was introduced in 1da1e07c835e900337714cfad6c32a8dc0b36ac3\n\nvalgrind output looks like this:\n==4738== Memcheck, a memory error detector\n==4738== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.\n==4738== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info\n==4738== Command: ./git-blame HEAD -- foo\n==4738== \n==4738== Invalid read of size 1\n==4738==    at 0x58B6F00: vfprintf (vfprintf.c:1636)\n==4738==    by 0x58E1298: vsnprintf (vsnprintf.c:119)\n==4738==    by 0x5107ED: vreportf (usage.c:12)\n==4738==    by 0x510823: die_builtin (usage.c:36)\n==4738==    by 0x510A82: die (usage.c:103)\n==4738==    by 0x41318F: cmd_blame (blame.c:2716)\n==4738==    by 0x405B52: run_builtin (git.c:351)\n==4738==    by 0x405B52: handle_builtin (git.c:530)\n==4738==    by 0x404C69: main (git.c:653)\n==4738==  Address 0x5f042d0 is 0 bytes inside a block of size 5 free'd\n==4738==    at 0x4C29E90: free (vg_replace_malloc.c:473)\n==4738==    by 0x4C1621: object_array_release_entry.isra.0 (object.c:354)\n==4738==    by 0x4C1F73: object_array_clear (object.c:380)\n==4738==    by 0x4E8E05: prepare_revision_walk (revision.c:2739)\n==4738==    by 0x41153E: cmd_blame (blame.c:2705)\n==4738==    by 0x405B52: run_builtin (git.c:351)\n==4738==    by 0x405B52: handle_builtin (git.c:530)\n==4738==    by 0x404C69: main (git.c:653)\n==4738== \n==4738== Invalid read of size 1\n==4738==    at 0x58E50D0: _IO_default_xsputn (genops.c:475)\n==4738==    by 0x58B6EC1: vfprintf (vfprintf.c:1636)\n==4738==    by 0x58E1298: vsnprintf (vsnprintf.c:119)\n==4738==    by 0x5107ED: vreportf (usage.c:12)\n==4738==    by 0x510823: die_builtin (usage.c:36)\n==4738==    by 0x510A82: die (usage.c:103)\n==4738==    by 0x41318F: cmd_blame (blame.c:2716)\n==4738==    by 0x405B52: run_builtin (git.c:351)\n==4738==    by 0x405B52: handle_builtin (git.c:530)\n==4738==    by 0x404C69: main (git.c:653)\n==4738==  Address 0x5f042d0 is 0 bytes inside a block of size 5 free'd\n==4738==    at 0x4C29E90: free (vg_replace_malloc.c:473)\n==4738==    by 0x4C1621: object_array_release_entry.isra.0 (object.c:354)\n==4738==    by 0x4C1F73: object_array_clear (object.c:380)\n==4738==    by 0x4E8E05: prepare_revision_walk (revision.c:2739)\n==4738==    by 0x41153E: cmd_blame (blame.c:2705)\n==4738==    by 0x405B52: run_builtin (git.c:351)\n==4738==    by 0x405B52: handle_builtin (git.c:530)\n==4738==    by 0x404C69: main (git.c:653)\n==4738== \n==4738== Invalid read of size 1\n==4738==    at 0x58E50DE: _IO_default_xsputn (genops.c:474)\n==4738==    by 0x58B6EC1: vfprintf (vfprintf.c:1636)\n==4738==    by 0x58E1298: vsnprintf (vsnprintf.c:119)\n==4738==    by 0x5107ED: vreportf (usage.c:12)\n==4738==    by 0x510823: die_builtin (usage.c:36)\n==4738==    by 0x510A82: die (usage.c:103)\n==4738==    by 0x41318F: cmd_blame (blame.c:2716)\n==4738==    by 0x405B52: run_builtin (git.c:351)\n==4738==    by 0x405B52: handle_builtin (git.c:530)\n==4738==    by 0x404C69: main (git.c:653)\n==4738==  Address 0x5f042d2 is 2 bytes inside a block of size 5 free'd\n==4738==    at 0x4C29E90: free (vg_replace_malloc.c:473)\n==4738==    by 0x4C1621: object_array_release_entry.isra.0 (object.c:354)\n==4738==    by 0x4C1F73: object_array_clear (object.c:380)\n==4738==    by 0x4E8E05: prepare_revision_walk (revision.c:2739)\n==4738==    by 0x41153E: cmd_blame (blame.c:2705)\n==4738==    by 0x405B52: run_builtin (git.c:351)\n==4738==    by 0x405B52: handle_builtin (git.c:530)\n==4738==    by 0x404C69: main (git.c:653)\n==4738== \nfatal: no such path foo in HEAD\n==4738== \n==4738== HEAP SUMMARY:\n==4738==     in use at exit: 733,417 bytes in 807 blocks\n==4738==   total heap usage: 1,505 allocs, 698 frees, 915,428 bytes allocated\n==4738== \n==4738== LEAK SUMMARY:\n==4738==    definitely lost: 0 bytes in 0 blocks\n==4738==    indirectly lost: 0 bytes in 0 blocks\n==4738==      possibly lost: 0 bytes in 0 blocks\n==4738==    still reachable: 733,417 bytes in 807 blocks\n==4738==         suppressed: 0 bytes in 0 blocks\n==4738== Rerun with --leak-check=full to see details of leaked memory\n==4738== \n==4738== For counts of detected and suppressed errors, rerun with: -v\n==4738== ERROR SUMMARY: 9 errors from 3 contexts (suppressed: 0 from 0)\n\nCheers,\n\nMike\n"},{"id":"255568","messageId":"20150203093245.3733.71523@typhoon","threadId":"38490","inReplyTo":"20150203091715.GA25445@glandium.org","subject":"Re: use-after-free leads to git-blame writing garbage in error message","fromName":"Lukas Fleischer","fromEmail":"git@cryptocrack.de","sentAt":"2015-02-03T09:32:45Z","receivedAt":"2015-02-03T09:32:45Z","isPatch":false,"sender":{"key":"git@cryptocrack.de","avatar":null},"body":"On Tue, 03 Feb 2015 at 10:17:15, Mike Hommey wrote:\n> Symptoms:\n>   $ git blame HEAD -- foo\n>   fatal: no such path foo in <random garbage>\n> \n> Expected output:\n>   $ git blame HEAD -- foo\n>   fatal: no such path foo in HEAD\n> \n> Bisect says this was introduced in 1da1e07c835e900337714cfad6c32a8dc0b36ac3\n> [...]\n\nThis should be fixed by commit a46442f (blame.c: fix garbled error\nmessage, 2015-01-12) which is in next.\n"},{"id":"255570","messageId":"20150203093843.GA14981@glandium.org","threadId":"38490","inReplyTo":"20150203093245.3733.71523@typhoon","subject":"Re: use-after-free leads to git-blame writing garbage in error message","fromName":"Mike Hommey","fromEmail":"mh@glandium.org","sentAt":"2015-02-03T09:38:43Z","receivedAt":"2015-02-03T09:38:43Z","isPatch":false,"sender":{"key":"mh@glandium.org","avatar":"https://avatars.githubusercontent.com/u/1038527?v=4"},"body":"On Tue, Feb 03, 2015 at 10:32:45AM +0100, Lukas Fleischer wrote:\n> On Tue, 03 Feb 2015 at 10:17:15, Mike Hommey wrote:\n> > Symptoms: $ git blame HEAD -- foo fatal: no such path foo in <random\n> > garbage>\n> > \n> > Expected output: $ git blame HEAD -- foo fatal: no such path foo in\n> > HEAD\n> > \n> > Bisect says this was introduced in\n> > 1da1e07c835e900337714cfad6c32a8dc0b36ac3 [...]\n> \n> This should be fixed by commit a46442f (blame.c: fix garbled error\n> message, 2015-01-12) which is in next.\n\nIndeed it is, I should have checked next.\n\nThanks.\n\nMike\n"}]}