{"thread":{"id":"48133","subject":"Null pointer dereference in git-submodule","startedAt":"2018-03-24T17:57:09Z","lastAt":"2018-03-24T20:43:14Z","messageCount":2,"participants":["Jeremy Feusi","René Scharfe"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"342831","messageId":"20180324174234.GA3779@feusi.co","threadId":"48133","inReplyTo":null,"subject":"Null pointer dereference in git-submodule","fromName":"Jeremy Feusi","fromEmail":"jeremy@feusi.co","sentAt":"2018-03-24T17:42:35Z","receivedAt":"2018-03-24T17:57:09Z","isPatch":false,"sender":{"key":"jeremy@feusi.co","avatar":null},"body":"Hi,\nWhile bootstrapping a gnu repository I noticed that git segfaulted when\ncalled as \"git submodule status\". After compiling git with address\nsanitizer and minimizing the directory I finally narrowed it down to the\nfiles which I have attached as a tar archive. Here is a detailed backtrace:\n\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==63400==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000c27a93 bp 0x7ffdcb4eec10 sp 0x7ffdcb4eeb80 T0)\n==63400==The signal is caused by a READ memory access.\n==63400==Hint: address points to the zero page.\n    #0 0xc27a92 in refs_read_raw_ref /home/jfe/git/refs.c:1451:20\n    #1 0xc174a6 in refs_resolve_ref_unsafe /home/jfe/git/refs.c:1493:7\n    #2 0xc1826a in refs_read_ref_full /home/jfe/git/refs.c:224:6\n    #3 0xc26d53 in refs_head_ref /home/jfe/git/refs.c:1314:7\n    #4 0x8071e6 in status_submodule /home/jfe/git/builtin/submodule--helper.c:658:7\n    #5 0x806a89 in status_submodule_cb /home/jfe/git/builtin/submodule--helper.c:699:2\n    #6 0x80523e in for_each_listed_submodule /home/jfe/git/builtin/submodule--helper.c:438:3\n    #7 0x7f7e9a in module_status /home/jfe/git/builtin/submodule--helper.c:732:2\n    #8 0x7efd69 in cmd_submodule__helper /home/jfe/git/builtin/submodule--helper.c:1859:11\n    #9 0x51e024 in run_builtin /home/jfe/git/git.c:346:11\n    #10 0x5192c2 in handle_builtin /home/jfe/git/git.c:554:8\n    #11 0x51d0f0 in run_argv /home/jfe/git/git.c:606:4\n    #12 0x518600 in cmd_main /home/jfe/git/git.c:683:19\n    #13 0x8501d6 in main /home/jfe/git/common-main.c:43:9\n    #14 0x7f49fdaf2f29 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20f29)\n    #15 0x41f4b9 in _start (/home/jfe/git/inst/libexec/git-core/git+0x41f4b9)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/jfe/git/refs.c:1451:20 in refs_read_raw_ref\n==63400==ABORTING\n\nAs mentioned above, this bug is triggered by issuing the command\n\"git submodule status\" while in the attached directory.\n\nThis bug was confirmed on Debian with version 2.16.1 and\n2.17.0.rc1.35.g90bbd502d as well as on Arch Linux with version 2.16.2\nwhere further output is given by git:\n\n/usr/lib/git-core/git-submodule: line 979:  8119 Segmentation fault      (core dumped) git ${wt_prefix:+-C \"$wt_prefix\"} ${prefix:+--super-prefix \"$prefix\"} submodule--helper status ${GIT_QUIET:+--quiet} ${cached:+--cached} ${recursive:+--recursive} \"$@\"\n\ncheers\nJeremy\n"},{"id":"342852","messageId":"a7ad9dbf-1b0f-efc6-3a17-51cf25381ce5@web.de","threadId":"48133","inReplyTo":"20180324174234.GA3779@feusi.co","subject":"Re: Null pointer dereference in git-submodule","fromName":"René Scharfe","fromEmail":"l.s.r@web.de","sentAt":"2018-03-24T20:42:57Z","receivedAt":"2018-03-24T20:43:14Z","isPatch":false,"sender":{"key":"l.s.r@web.de","avatar":"https://avatars.githubusercontent.com/u/26122331?v=4"},"body":"Am 24.03.2018 um 18:42 schrieb Jeremy Feusi:\n> Hi,\n> While bootstrapping a gnu repository I noticed that git segfaulted when\n> called as \"git submodule status\". After compiling git with address\n> sanitizer and minimizing the directory I finally narrowed it down to the\n> files which I have attached as a tar archive. Here is a detailed backtrace:\n> \n> AddressSanitizer:DEADLYSIGNAL\n> =================================================================\n> ==63400==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000c27a93 bp 0x7ffdcb4eec10 sp 0x7ffdcb4eeb80 T0)\n> ==63400==The signal is caused by a READ memory access.\n> ==63400==Hint: address points to the zero page.\n>      #0 0xc27a92 in refs_read_raw_ref /home/jfe/git/refs.c:1451:20\n>      #1 0xc174a6 in refs_resolve_ref_unsafe /home/jfe/git/refs.c:1493:7\n>      #2 0xc1826a in refs_read_ref_full /home/jfe/git/refs.c:224:6\n>      #3 0xc26d53 in refs_head_ref /home/jfe/git/refs.c:1314:7\n>      #4 0x8071e6 in status_submodule /home/jfe/git/builtin/submodule--helper.c:658:7\n>      #5 0x806a89 in status_submodule_cb /home/jfe/git/builtin/submodule--helper.c:699:2\n>      #6 0x80523e in for_each_listed_submodule /home/jfe/git/builtin/submodule--helper.c:438:3\n>      #7 0x7f7e9a in module_status /home/jfe/git/builtin/submodule--helper.c:732:2\n>      #8 0x7efd69 in cmd_submodule__helper /home/jfe/git/builtin/submodule--helper.c:1859:11\n>      #9 0x51e024 in run_builtin /home/jfe/git/git.c:346:11\n>      #10 0x5192c2 in handle_builtin /home/jfe/git/git.c:554:8\n>      #11 0x51d0f0 in run_argv /home/jfe/git/git.c:606:4\n>      #12 0x518600 in cmd_main /home/jfe/git/git.c:683:19\n>      #13 0x8501d6 in main /home/jfe/git/common-main.c:43:9\n>      #14 0x7f49fdaf2f29 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20f29)\n>      #15 0x41f4b9 in _start (/home/jfe/git/inst/libexec/git-core/git+0x41f4b9)\n> \n> AddressSanitizer can not provide additional info.\n> SUMMARY: AddressSanitizer: SEGV /home/jfe/git/refs.c:1451:20 in refs_read_raw_ref\n> ==63400==ABORTING\n> \n> As mentioned above, this bug is triggered by issuing the command\n> \"git submodule status\" while in the attached directory.\n> \n> This bug was confirmed on Debian with version 2.16.1 and\n> 2.17.0.rc1.35.g90bbd502d as well as on Arch Linux with version 2.16.2\n> where further output is given by git:\n> \n> /usr/lib/git-core/git-submodule: line 979:  8119 Segmentation fault      (core dumped) git ${wt_prefix:+-C \"$wt_prefix\"} ${prefix:+--super-prefix \"$prefix\"} submodule--helper status ${GIT_QUIET:+--quiet} ${cached:+--cached} ${recursive:+--recursive} \"$@\"\n> \n\nYou may have minimized too much.  With the patch below I get:\n\n\tfatal: no ref store in submodule 'gnulib'\n\nI guess you'll get a different one in your original repo.\n\nThe patch seems like a good idea in any case, though.\n\n-- >8 --\nSubject: [PATCH] submodule: check for NULL return of get_submodule_ref_store()\n\nrefs_head_ref() requires a valid ref_store pointer to be given as its\nfirst argument.  get_submodule_ref_store() can return NULL.  Exit and\nreport the failure to find a ref store in that case instead of\nsegfaulting.\n\nReported-by: Jeremy Feusi <jeremy@feusi.co>\nSigned-off-by: Rene Scharfe <l.s.r@web.de>\n---\n builtin/submodule--helper.c | 6 ++++--\n 1 file changed, 4 insertions(+), 2 deletions(-)\n\ndiff --git a/builtin/submodule--helper.c b/builtin/submodule--helper.c\nindex ee020d4749..0f74e81005 100644\n--- a/builtin/submodule--helper.c\n+++ b/builtin/submodule--helper.c\n@@ -654,9 +654,11 @@ static void status_submodule(const char *path, const struct object_id *ce_oid,\n \t\t\t     displaypath);\n \t} else if (!(flags & OPT_CACHED)) {\n \t\tstruct object_id oid;\n+\t\tstruct ref_store *refs = get_submodule_ref_store(path);\n \n-\t\tif (refs_head_ref(get_submodule_ref_store(path),\n-\t\t\t\t  handle_submodule_head_ref, &oid))\n+\t\tif (!refs)\n+\t\t\tdie(_(\"no ref store in submodule '%s'\"), path);\n+\t\tif (refs_head_ref(refs, handle_submodule_head_ref, &oid))\n \t\t\tdie(_(\"could not resolve HEAD ref inside the \"\n \t\t\t      \"submodule '%s'\"), path);\n \n-- \n2.16.3\n"}]}