{"thread":{"id":"55463","subject":"Possible memory leak bug reports for the latest \"git\" repository.","startedAt":"2021-04-09T14:00:47Z","lastAt":"2021-04-09T18:46:15Z","messageCount":3,"participants":["Andrzej Hunt","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"421396","messageId":"CAPb83E_r-gx-zDU1eLwPLfC_Zd-4Hyb_x6t_s_pGHwfxuQ0+vQ@mail.gmail.com","threadId":"55463","inReplyTo":null,"subject":"Possible memory leak bug reports for the latest \"git\" repository.","fromName":"","fromEmail":"","sentAt":"2021-04-09T13:59:44Z","receivedAt":"2021-04-09T14:00:47Z","isPatch":false,"sender":null,"body":"Dear Git Development team.\n\nHi.\nRecently, we discovered that the vulnerable code of CVE-2019-9169 is\nincluded in the latest version (v2.31.1) of your source repository\n(https://github.com/git/git).\n\nVulnerable file: git/compat/regex/regexec.c\n\nRef: CVE-2019-9169 (https://nvd.nist.gov/vuln/detail/CVE-2019-9169)\n\nOriginal patch link:\nhttps://sourceware.org/git/?p=glibc.git;a=blobdiff;f=posix/regexec.c;h=084b1222d95b62eb2930166060174ef78cb74b02;hp=91d5a797b82e2679ceab74238416de06693e46ea;hb=583dd860d5b833037175247230a328f0050dbfe9;hpb=2bac7daa58da1a313bd452369b0508b31e146637\n\n\nAlthough the original vulnerability caused a heap-based buffer\nover-read, the vulnerable code seems to cause a memory leak in your\nrepository.\n\nCould you review whether this is a real vulnerability?\n\nThe below information shows our testing environments and results:\n\n*****************************************************************************************\nFirst test:\n\nOS: Ubuntu 16.04.07 LTS\nGit version: v2.31.1\nMakefile config:\n\n  1184 # Set CFLAGS, LDFLAGS and other *FLAGS variables. These might be\n  1185 # tweaked by config.* below as well as the command-line, both of\n  1186 # which'll override these defaults.\n  1187 CFLAGS = -g -O2 -Wall -fsanitize=address\n  1188 LDFLAGS =\n\nResult:\n\n$ ./git-log -i '\\(\\(\\)*.\\)*\\(\\)\\(\\)\\1'\nfatal: your current branch 'master' does not have any commits yet\n=================================================================\n==27253==ERROR: LeakSanitizer: detected memory leaks\n\nDirect leak of 65 byte(s) in 1 object(s) allocated from:\n    #0 0x7f6ff01de961 in realloc\n(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)\n    #1 0x843ee5 in xrealloc  /HDD/POC/CVE-2019-9169/git-2.31.1/wrapper.c:126\n\nSUMMARY: AddressSanitizer: 65 byte(s) leaked in 1 allocation(s).\n*****************************************************************************************\n\n\n*****************************************************************************************\nSecond test:\n\nOS: Ubuntu 18.04.5 LTS\nGit version: v2.31.1\nMakefile config: Default\n\nResult:\n\n$ printf xxxxxxxxxxxxxx |valgrind --leak-check=full ./git-log -i '\\(\\(\\)*.\\)*\\1'\n==63105== Memcheck, a memory error detector\n==63105== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.\n==63105== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info\n==63105== Command: ./git-log -i \\\\(\\\\(\\\\)*.\\\\)*\\\\1\n==63105==\n==63105==\n==63105== HEAP SUMMARY:\n==63105==     in use at exit: 118,368,930 bytes in 76,720 blocks\n==63105==   total heap usage: 463,994 allocs, 387,274 frees,\n2,273,364,625 bytes allocated\n==63105==\n==63105== 40 bytes in 1 blocks are possibly lost in loss record 38 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x355BB5: chdir_notify_register (chdir-notify.c:18)\n==63105==    by 0x355BB5: chdir_notify_reparent (chdir-notify.c:48)\n==63105==    by 0x2D5DC6: packed_ref_store_create (packed-backend.c:207)\n==63105==    by 0x2D02BA: files_ref_store_create (files-backend.c:96)\n==63105==    by 0x2CC295: get_main_ref_store (refs.c:1900)\n==63105==    by 0x2E969D: handle_revision_pseudo_opt (revision.c:2578)\n==63105==    by 0x2E969D: setup_revisions (revision.c:2730)\n==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 40 bytes in 1 blocks are possibly lost in loss record 39 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x355BB5: chdir_notify_register (chdir-notify.c:18)\n==63105==    by 0x355BB5: chdir_notify_reparent (chdir-notify.c:48)\n==63105==    by 0x2D02D6: files_ref_store_create (files-backend.c:99)\n==63105==    by 0x2CC295: get_main_ref_store (refs.c:1900)\n==63105==    by 0x2E969D: handle_revision_pseudo_opt (revision.c:2578)\n==63105==    by 0x2E969D: setup_revisions (revision.c:2730)\n==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 40 bytes in 1 blocks are possibly lost in loss record 40 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x355BB5: chdir_notify_register (chdir-notify.c:18)\n==63105==    by 0x355BB5: chdir_notify_reparent (chdir-notify.c:48)\n==63105==    by 0x2D02E6: files_ref_store_create (files-backend.c:100)\n==63105==    by 0x2CC295: get_main_ref_store (refs.c:1900)\n==63105==    by 0x2E969D: handle_revision_pseudo_opt (revision.c:2578)\n==63105==    by 0x2E969D: setup_revisions (revision.c:2730)\n==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 65 bytes in 1 blocks are definitely lost in loss record 59 of 142\n==63105==    at 0x4C31A3F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x4C33D84: realloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x340345: xrealloc (wrapper.c:126)\n==63105==    by 0x30B93A: strbuf_grow (strbuf.c:98)\n==63105==    by 0x30C8EC: strbuf_vaddf (strbuf.c:392)\n==63105==    by 0x30CA33: strbuf_addf (strbuf.c:333)\n==63105==    by 0x2A9700: preprocess_options (parse-options.c:666)\n==63105==    by 0x2A9700: parse_options (parse-options.c:847)\n==63105==    by 0x18053E: cmd_log_init_finish (log.c:199)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 84 (56 direct, 28 indirect) bytes in 1 blocks are definitely\nlost in loss record 61 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x2AE9C0: copy_pathspec (pathspec.c:664)\n==63105==    by 0x2E993A: setup_revisions (revision.c:2844)\n==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 84 (56 direct, 28 indirect) bytes in 1 blocks are definitely\nlost in loss record 62 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x2AE9C0: copy_pathspec (pathspec.c:664)\n==63105==    by 0x2E996A: setup_revisions (revision.c:2849)\n==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 191 (112 direct, 79 indirect) bytes in 1 blocks are\ndefinitely lost in loss record 76 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x2AE381: parse_pathspec (pathspec.c:582)\n==63105==    by 0x2E9164: setup_revisions (revision.c:2800)\n==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 464 (448 direct, 16 indirect) bytes in 28 blocks are\ndefinitely lost in loss record 98 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x217A3D: commit_list_insert (commit.c:554)\n==63105==    by 0x217A3D: parse_commit_buffer (commit.c:447)\n==63105==    by 0x296F37: parse_object_buffer (object.c:217)\n==63105==    by 0x297070: parse_object (object.c:282)\n==63105==    by 0x274781: add_ref_decoration (log-tree.c:179)\n==63105==    by 0x2D5C53: do_for_each_repo_ref_iterator (iterator.c:418)\n==63105==    by 0x2CB9F8: do_for_each_ref (refs.c:1492)\n==63105==    by 0x274A65: load_ref_decorations (log-tree.c:211)\n==63105==    by 0x1807C9: cmd_log_init_finish (log.c:262)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==\n==63105== 37,468 (32 direct, 37,436 indirect) bytes in 1 blocks are\ndefinitely lost in loss record 120 of 142\n==63105==    at 0x4C33B25: calloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x3403AD: xcalloc (wrapper.c:140)\n==63105==    by 0x1806F4: cmd_log_init_finish (log.c:233)\n==63105==    by 0x18241F: cmd_log_init (log.c:275)\n==63105==    by 0x18241F: cmd_log (log.c:754)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==    by 0x1289A4: cmd_main (git.c:872)\n==63105==    by 0x127467: main (common-main.c:52)\n==63105==\n==63105== 184,176 (183,792 direct, 384 indirect) bytes in 11,487\nblocks are definitely lost in loss record 130 of 142\n==63105==    at 0x4C31B0F: malloc (in\n/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n==63105==    by 0x217A3D: commit_list_insert (commit.c:554)\n==63105==    by 0x217A3D: parse_commit_buffer (commit.c:447)\n==63105==    by 0x217CEC: repo_parse_commit_internal (commit.c:498)\n==63105==    by 0x2E4C3D: repo_parse_commit (commit.h:89)\n==63105==    by 0x2E4C3D: try_to_simplify_commit (revision.c:1007)\n==63105==    by 0x2E84AA: process_parents (revision.c:1140)\n==63105==    by 0x2EBFED: get_revision_1 (revision.c:3999)\n==63105==    by 0x2EC1BF: get_revision_internal (revision.c:4113)\n==63105==    by 0x2EC344: get_revision (revision.c:4187)\n==63105==    by 0x181538: cmd_log_walk (log.c:422)\n==63105==    by 0x182427: cmd_log (log.c:755)\n==63105==    by 0x12781D: run_builtin (git.c:453)\n==63105==    by 0x12781D: handle_builtin (git.c:704)\n==63105==\n==63105== LEAK SUMMARY:\n==63105==    definitely lost: 184,561 bytes in 11,520 blocks\n==63105==    indirectly lost: 37,971 bytes in 1,139 blocks\n==63105==      possibly lost: 120 bytes in 3 blocks\n==63105==    still reachable: 118,146,278 bytes in 64,058 blocks\n==63105==         suppressed: 0 bytes in 0 blocks\n==63105== Reachable blocks (those to which a pointer was found) are not shown.\n==63105== To see them, rerun with: --leak-check=full --show-leak-kinds=all\n==63105==\n==63105== For counts of detected and suppressed errors, rerun with: -v\n==63105== ERROR SUMMARY: 10 errors from 10 contexts (suppressed: 0 from 0)\n*****************************************************************************************\n\nThank you.\nBest regards,\nSeunghoon Woo, Jiyeon Han\n\n-- \n\nBest regards,\n\nSeunghoon Woo\nKorea University Dept. of Computer Science and Engineering\nComputer & Communication Security Lab.\nseunghoonwoo@korea.ac.kr\n(+82)10-8147-9308\n"},{"id":"421419","messageId":"b96f76f2-db00-cc7c-eb83-3033873023ec@ahunt.org","threadId":"55463","inReplyTo":"CAPb83E_r-gx-zDU1eLwPLfC_Zd-4Hyb_x6t_s_pGHwfxuQ0+vQ@mail.gmail.com","subject":"Re: Possible memory leak bug reports for the latest \"git\" repository.","fromName":"Andrzej Hunt","fromEmail":"andrzej@ahunt.org","sentAt":"2021-04-09T16:49:39Z","receivedAt":"2021-04-09T16:49:51Z","isPatch":false,"sender":{"key":"andrzej@ahunt.org","avatar":"https://avatars.githubusercontent.com/u/1546915?v=4"},"body":"On 09/04/2021 15:59, 우승훈[ 대학원석·박사통합과정수료연구(재학) / 컴퓨 \n터학과 ] wrote:\n> Dear Git Development team.\n> \n> Hi.\n> Recently, we discovered that the vulnerable code of CVE-2019-9169 is\n> included in the latest version (v2.31.1) of your source repository\n> (https://github.com/git/git).\n> \n> Vulnerable file: git/compat/regex/regexec.c\n> \n> Ref: CVE-2019-9169 (https://nvd.nist.gov/vuln/detail/CVE-2019-9169)\n> \n> Original patch link:\n> https://sourceware.org/git/?p=glibc.git;a=blobdiff;f=posix/regexec.c;h=084b1222d95b62eb2930166060174ef78cb74b02;hp=91d5a797b82e2679ceab74238416de06693e46ea;hb=583dd860d5b833037175247230a328f0050dbfe9;hpb=2bac7daa58da1a313bd452369b0508b31e146637\n> \n> \n> Although the original vulnerability caused a heap-based buffer\n> over-read, the vulnerable code seems to cause a memory leak in your\n> repository.\n\nI don't feel qualified to comment on the vulnerability itself (except \nthat by inspection the code looks the same) - hopefully someone with \nmore expertise can chime in. That said, I ran your repro example through \na debugger and at least /on my system/, the problematic code is not \nbeing called when using /the specific testcases you supplied/.\n\nRegarding the memory leaks you have found: they are not of particular \nconcern - git has a lot of small memory leaks, they're ugly but not \nimpactful (that said - I've been working on fixing some of those leaks). \nIn fact I don't think any of the leaks you found are in any way related \nto the regex code - see analysis inline:\n\n> $ ./git-log -i '\\(\\(\\)*.\\)*\\(\\)\\(\\)\\1'\n> fatal: your current branch 'master' does not have any commits yet\n> =================================================================\n> ==27253==ERROR: LeakSanitizer: detected memory leaks\n> \n> Direct leak of 65 byte(s) in 1 object(s) allocated from:\n>      #0 0x7f6ff01de961 in realloc\n> (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98961)\n>      #1 0x843ee5 in xrealloc  /HDD/POC/CVE-2019-9169/git-2.31.1/wrapper.c:126\n> \n> SUMMARY: AddressSanitizer: 65 byte(s) leaked in 1 allocation(s).\n> *****************************************************************************************\n\nUnfortunately this log is a bit useless: LSAN should print the call \nstack down to realloc, but it sometimes misses everything above the \nwrapper calls. I haven't managed to figure out why this is happening. \nThat said, I can't reproduce this leak locally (clang-11 + ASAN + LSAN), \nso it's plausible that it was fixed recently.\n\n> \n> \n> *****************************************************************************************\n> Second test:\n> \n> OS: Ubuntu 18.04.5 LTS\n> Git version: v2.31.1\n> Makefile config: Default\n> \n> Result:\n> \n> $ printf xxxxxxxxxxxxxx |valgrind --leak-check=full ./git-log -i '\\(\\(\\)*.\\)*\\1'\n> ==63105== Memcheck, a memory error detector\n> ==63105== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.\n> ==63105== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info\n> ==63105== Command: ./git-log -i \\\\(\\\\(\\\\)*.\\\\)*\\\\1\n> ==63105==\n> ==63105==\n> ==63105== HEAP SUMMARY:\n> ==63105==     in use at exit: 118,368,930 bytes in 76,720 blocks\n> ==63105==   total heap usage: 463,994 allocs, 387,274 frees,\n> 2,273,364,625 bytes allocated\n> ==63105==\n> ==63105== 40 bytes in 1 blocks are possibly lost in loss record 38 of 142\n> ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x355BB5: chdir_notify_register (chdir-notify.c:18)\n> ==63105==    by 0x355BB5: chdir_notify_reparent (chdir-notify.c:48)\n> ==63105==    by 0x2D5DC6: packed_ref_store_create (packed-backend.c:207)\n> ==63105==    by 0x2D02BA: files_ref_store_create (files-backend.c:96)\n> ==63105==    by 0x2CC295: get_main_ref_store (refs.c:1900)\n> ==63105==    by 0x2E969D: handle_revision_pseudo_opt (revision.c:2578)\n> ==63105==    by 0x2E969D: setup_revisions (revision.c:2730)\n> ==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52)\n> ==63105==\n> ==63105== 40 bytes in 1 blocks are possibly lost in loss record 39 of 142\n> ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x355BB5: chdir_notify_register (chdir-notify.c:18)\n> ==63105==    by 0x355BB5: chdir_notify_reparent (chdir-notify.c:48)\n> ==63105==    by 0x2D02D6: files_ref_store_create (files-backend.c:99)\n> ==63105==    by 0x2CC295: get_main_ref_store (refs.c:1900)\n> ==63105==    by 0x2E969D: handle_revision_pseudo_opt (revision.c:2578)\n> ==63105==    by 0x2E969D: setup_revisions (revision.c:2730)\n> ==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52)\n> ==63105==\n> ==63105== 40 bytes in 1 blocks are possibly lost in loss record 40 of 142\n> ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x355BB5: chdir_notify_register (chdir-notify.c:18)\n> ==63105==    by 0x355BB5: chdir_notify_reparent (chdir-notify.c:48)\n> ==63105==    by 0x2D02E6: files_ref_store_create (files-backend.c:100)\n> ==63105==    by 0x2CC295: get_main_ref_store (refs.c:1900)\n> ==63105==    by 0x2E969D: handle_revision_pseudo_opt (revision.c:2578)\n> ==63105==    by 0x2E969D: setup_revisions (revision.c:2730)\n> ==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52)\n> ==63105==\n> ==63105== 65 bytes in 1 blocks are definitely lost in loss record 59 of 142\n\nThese are a bit odd: chdir_notify_register() is attaching the newly \nallocated memory to a static list (chdir_notify_entries), and I can't \nsee any obvious reason why this would leak (but maybe valgrind doesn't \nlike static pointers)? Either way, this doesn't seem to be anywhere near \nthe regex code.\n\n> ==63105==    at 0x4C31A3F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x4C33D84: realloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x340345: xrealloc (wrapper.c:126)\n> ==63105==    by 0x30B93A: strbuf_grow (strbuf.c:98)\n> ==63105==    by 0x30C8EC: strbuf_vaddf (strbuf.c:392)\n> ==63105==    by 0x30CA33: strbuf_addf (strbuf.c:333)\n> ==63105==    by 0x2A9700: preprocess_options (parse-options.c:666)\n> ==63105==    by 0x2A9700: parse_options (parse-options.c:847)\n> ==63105==    by 0x18053E: cmd_log_init_finish (log.c:199)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52)\n> ==63105==\n\nThis was fixed in:\nhttps://github.com/git/git/commit/64cc539fd2f8e02f39cfae21e9523da2532c0467#diff-1f0cbd43fdb6fcca38e0bcd390901118a948a9fb3a4f9b2e2edb2783d343f0b8\n\n> ==63105== 84 (56 direct, 28 indirect) bytes in 1 blocks are definitely\n> lost in loss record 61 of 142\n> ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x2AE9C0: copy_pathspec (pathspec.c:664)\n> ==63105==    by 0x2E993A: setup_revisions (revision.c:2844)\n> ==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52 > ==63105==\n> ==63105== 84 (56 direct, 28 indirect) bytes in 1 blocks are definitely\n> lost in loss record 62 of 142\n> ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x2AE9C0: copy_pathspec (pathspec.c:664)\n> ==63105==    by 0x2E996A: setup_revisions (revision.c:2849)\n> ==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52)\n> ==63105==\n> ==63105== 191 (112 direct, 79 indirect) bytes in 1 blocks are\n> definitely lost in loss record 76 of 142\n> ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x2AE381: parse_pathspec (pathspec.c:582)\n> ==63105==    by 0x2E9164: setup_revisions (revision.c:2800)\n> ==63105==    by 0x180562: cmd_log_init_finish (log.c:206)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52)\n> ==63105==\n> ==63105== 464 (448 direct, 16 indirect) bytes in 28 blocks are\n> definitely lost in loss record 98 of 14 > ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x217A3D: commit_list_insert (commit.c:554)\n> ==63105==    by 0x217A3D: parse_commit_buffer (commit.c:447)\n> ==63105==    by 0x296F37: parse_object_buffer (object.c:217)\n> ==63105==    by 0x297070: parse_object (object.c:282)\n> ==63105==    by 0x274781: add_ref_decoration (log-tree.c:179)\n> ==63105==    by 0x2D5C53: do_for_each_repo_ref_iterator (iterator.c:418)\n> ==63105==    by 0x2CB9F8: do_for_each_ref (refs.c:1492)\n> ==63105==    by 0x274A65: load_ref_decorations (log-tree.c:211)\n> ==63105==    by 0x1807C9: cmd_log_init_finish (log.c:262)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==\n> ==63105== 37,468 (32 direct, 37,436 indirect) bytes in 1 blocks are\n> definitely lost in loss record 120 of 142\n> ==63105==    at 0x4C33B25: calloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x3403AD: xcalloc (wrapper.c:140)\n> ==63105==    by 0x1806F4: cmd_log_init_finish (log.c:233)\n> ==63105==    by 0x18241F: cmd_log_init (log.c:275)\n> ==63105==    by 0x18241F: cmd_log (log.c:754)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n> ==63105==    by 0x1289A4: cmd_main (git.c:872)\n> ==63105==    by 0x127467: main (common-main.c:52)\n> ==63105==\n\nThese aren't really \"real\" leaks because they're populating a rev_info \nthat is owned by cmd_log. In other words: the data isn't leaked until \ncmd_log() returns, and by that point we don't care anymore.\n\nThat said, I have a patch prepared to UNLEAK the rev_info in question \nwhich will suppress these leaks when running with \n-DSUPPRESS_ANNOTATED_LEAKS, which I'll probably be sending out soon.\n\n> ==63105== 184,176 (183,792 direct, 384 indirect) bytes in 11,487\n> blocks are definitely lost in loss record 130 of 142\n> ==63105==    at 0x4C31B0F: malloc (in\n> /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> ==63105==    by 0x217A3D: commit_list_insert (commit.c:554)\n> ==63105==    by 0x217A3D: parse_commit_buffer (commit.c:447)\n> ==63105==    by 0x217CEC: repo_parse_commit_internal (commit.c:498)\n> ==63105==    by 0x2E4C3D: repo_parse_commit (commit.h:89)\n> ==63105==    by 0x2E4C3D: try_to_simplify_commit (revision.c:1007)\n> ==63105==    by 0x2E84AA: process_parents (revision.c:1140)\n> ==63105==    by 0x2EBFED: get_revision_1 (revision.c:3999)\n> ==63105==    by 0x2EC1BF: get_revision_internal (revision.c:4113)\n> ==63105==    by 0x2EC344: get_revision (revision.c:4187)\n> ==63105==    by 0x181538: cmd_log_walk (log.c:422)\n> ==63105==    by 0x182427: cmd_log (log.c:755)\n> ==63105==    by 0x12781D: run_builtin (git.c:453)\n> ==63105==    by 0x12781D: handle_builtin (git.c:704)\n\nI suspect this is similar to the last bunch: we end up leaking anything \nthat's added to rev_info when cmd_log() returns. Not a big deal, but it \nwill also be supressed with an UNLEAK in future.\n\nATB,\n     Andrzej\n"},{"id":"421452","messageId":"YHCg8ycLahSwNvJL@coredump.intra.peff.net","threadId":"55463","inReplyTo":"b96f76f2-db00-cc7c-eb83-3033873023ec@ahunt.org","subject":"Re: Possible memory leak bug reports for the latest \"git\" repository.","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-04-09T18:46:11Z","receivedAt":"2021-04-09T18:46:15Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Apr 09, 2021 at 06:49:39PM +0200, Andrzej Hunt wrote:\n\n> > ==63105== 40 bytes in 1 blocks are possibly lost in loss record 38 of 142\n> > ==63105==    at 0x4C31B0F: malloc (in\n> > /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)\n> > ==63105==    by 0x34013A: do_xmalloc (wrapper.c:41)\n> > ==63105==    by 0x355BB5: chdir_notify_register (chdir-notify.c:18)\n> [...]\n> \n> These are a bit odd: chdir_notify_register() is attaching the newly\n> allocated memory to a static list (chdir_notify_entries), and I can't see\n> any obvious reason why this would leak (but maybe valgrind doesn't like\n> static pointers)? Either way, this doesn't seem to be anywhere near the\n> regex code.\n\nThese \"possibly lost\" are false positives; there's more discussion in\nthis thread:\n\n  https://lore.kernel.org/git/20201117002435.GA13516@coredump.intra.peff.net/\n\n-Peff\n"}]}