{"thread":{"id":"57722","subject":"bugreport - SEGFAULT on 'git show-branch --current --reflog=3'","startedAt":"2022-04-13T08:41:14Z","lastAt":"2022-04-14T07:40:51Z","messageCount":6,"participants":["Gregory David","Ævar Arnfjörð Bjarmason"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"453475","messageId":"b6113b91-6613-42b5-ca85-1004099b65c4@p1sec.com","threadId":"57722","inReplyTo":null,"subject":"bugreport - SEGFAULT on 'git show-branch --current --reflog=3'","fromName":"Gregory David","fromEmail":"gregory.david@p1sec.com","sentAt":"2022-04-13T08:39:35Z","receivedAt":"2022-04-13T08:41:14Z","isPatch":false,"sender":{"key":"gregory.david@p1sec.com","avatar":"https://gravatar.com/avatar/4fdf1717095ab69bdb7ecf30c8f0efdf273e91591f65b043562a93b27239a944?d=mp&s=160"},"body":"Hi, this bugreport is about a SEGFAULT on git binary when running in\nthis repository (for example, as it also segfault on other private\nrepositories): https://framagit.org/groolot-association/osc_looper.git\n\n\nWhat did you do before the bug happened? (Steps to reproduce your\nissue) I just wanted to list branches, and so playing with 'git\nshow-branch --current --reflog=3' in the repository\nhttps://framagit.org/groolot-association/osc_looper.git\n\nWhat did you expect to happen? (Expected behavior)\nNot to segfault\n\nWhat happened instead? (Actual behavior)\nThis command fails with a SEGFAULT on version 2.35.1, 2.20.1 and 2.17.1\nIt also SEGFAULT on branch 'next' of github git repository.\n\nWhat's different between what you expected and what actually happened?\nSegfault\n\nAnything else you want to add:\nSegfaut happened when '--current' AND '--reflog=3' are provided together\n\nPlease review the rest of the bug report below.\nYou can delete any lines you don't wish to share.\n\n\n[System Info]\ngit version:\ngit version 2.35.1\ncpu: x86_64\nno commit associated with this build\nsizeof-long: 8\nsizeof-size_t: 8\nshell-path: /bin/sh\nuname: Linux 5.16.0-4-amd64 #1 SMP PREEMPT Debian 5.16.12-1 (2022-03-08)\nx86_64\ncompiler info: gnuc: 11.2\nlibc info: glibc: 2.33\n$SHELL (typically, interactive shell): /usr/bin/zsh\n\n\nBest regards\n\n-- \nGregory David\nSecurity Engineer\nhttps://www.p1sec.com"},{"id":"453478","messageId":"220413.864k2xgk51.gmgdl@evledraar.gmail.com","threadId":"57722","inReplyTo":"b6113b91-6613-42b5-ca85-1004099b65c4@p1sec.com","subject":"Re: bugreport - SEGFAULT on 'git show-branch --current --reflog=3'","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2022-04-13T13:57:57Z","receivedAt":"2022-04-13T13:58:42Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Wed, Apr 13 2022, Gregory David wrote:\n\n> [[PGP Signed Part:Undecided]]\n> Hi, this bugreport is about a SEGFAULT on git binary when running in\n> this repository (for example, as it also segfault on other private\n> repositories): https://framagit.org/groolot-association/osc_looper.git\n>\n>\n> What did you do before the bug happened? (Steps to reproduce your\n> issue) I just wanted to list branches, and so playing with 'git\n> show-branch --current --reflog=3' in the repository\n> https://framagit.org/groolot-association/osc_looper.git\n>\n> What did you expect to happen? (Expected behavior)\n> Not to segfault\n>\n> What happened instead? (Actual behavior)\n> This command fails with a SEGFAULT on version 2.35.1, 2.20.1 and 2.17.1\n> It also SEGFAULT on branch 'next' of github git repository.\n>\n> What's different between what you expected and what actually happened?\n> Segfault\n>\n> Anything else you want to add:\n> Segfaut happened when '--current' AND '--reflog=3' are provided together\n>\n> Please review the rest of the bug report below.\n> You can delete any lines you don't wish to share.\n>\n>\n> [System Info]\n> git version:\n> git version 2.35.1\n> cpu: x86_64\n> no commit associated with this build\n> sizeof-long: 8\n> sizeof-size_t: 8\n> shell-path: /bin/sh\n> uname: Linux 5.16.0-4-amd64 #1 SMP PREEMPT Debian 5.16.12-1 (2022-03-08)\n> x86_64\n> compiler info: gnuc: 11.2\n> libc info: glibc: 2.33\n> $SHELL (typically, interactive shell): /usr/bin/zsh\n\nThis appears to fix it, but I didn't have time to further validate it,\ncome up with a test etc:\n\ndiff --git a/builtin/show-branch.c b/builtin/show-branch.c\nindex 330b0553b9d..be3890b2dd6 100644\n--- a/builtin/show-branch.c\n+++ b/builtin/show-branch.c\n@@ -881,10 +881,9 @@ int cmd_show_branch(int ac, const char **av, const char *prefix)\n \t\t\t\t       get_color_reset_code(), ref_name[i]);\n \t\t\t}\n \n-\t\t\tif (!reflog) {\n+\t\t\tif (!reflog || !reflog_msg[i])\n \t\t\t\t/* header lines never need name */\n \t\t\t\tshow_one_commit(rev[i], 1);\n-\t\t\t}\n \t\t\telse\n \t\t\t\tputs(reflog_msg[i]);\n \n\n"},{"id":"453490","messageId":"6d510d78-9b0b-c463-889b-cd3855ccdd1b@p1sec.com","threadId":"57722","inReplyTo":"220413.864k2xgk51.gmgdl@evledraar.gmail.com","subject":"Re: bugreport - SEGFAULT on 'git show-branch --current --reflog=3'","fromName":"Gregory David","fromEmail":"gregory.david@p1sec.com","sentAt":"2022-04-13T15:48:57Z","receivedAt":"2022-04-13T15:49:04Z","isPatch":false,"sender":{"key":"gregory.david@p1sec.com","avatar":"https://gravatar.com/avatar/4fdf1717095ab69bdb7ecf30c8f0efdf273e91591f65b043562a93b27239a944?d=mp&s=160"},"body":"Thanks a lot Aevar!\n\nDon't you mean this:\n\ndiff --git a/builtin/show-branch.c b/builtin/show-branch.c\nindex 330b0553b9..2a5c31729d 100644\n--- a/builtin/show-branch.c\n+++ b/builtin/show-branch.c\n@@ -881,7 +881,7 @@ int cmd_show_branch(int ac, const char **av, const\nchar *prefix)\n                                       get_color_reset_code(), ref_name[i]);\n                        }\n\n-                       if (!reflog) {\n+                       if (!reflog || !rev[i]) {\n                                /* header lines never need name */\n                                show_one_commit(rev[i], 1);\n                        }\n\nBest regards.\n\nOn 13/04/2022 13:57, Ævar Arnfjörð Bjarmason wrote:\n> \n> On Wed, Apr 13 2022, Gregory David wrote:\n> \n>> [[PGP Signed Part:Undecided]]\n>> Hi, this bugreport is about a SEGFAULT on git binary when running in\n>> this repository (for example, as it also segfault on other private\n>> repositories): https://framagit.org/groolot-association/osc_looper.git\n>>\n>>\n>> What did you do before the bug happened? (Steps to reproduce your\n>> issue) I just wanted to list branches, and so playing with 'git\n>> show-branch --current --reflog=3' in the repository\n>> https://framagit.org/groolot-association/osc_looper.git\n>>\n>> What did you expect to happen? (Expected behavior)\n>> Not to segfault\n>>\n>> What happened instead? (Actual behavior)\n>> This command fails with a SEGFAULT on version 2.35.1, 2.20.1 and 2.17.1\n>> It also SEGFAULT on branch 'next' of github git repository.\n>>\n>> What's different between what you expected and what actually happened?\n>> Segfault\n>>\n>> Anything else you want to add:\n>> Segfaut happened when '--current' AND '--reflog=3' are provided together\n>>\n>> Please review the rest of the bug report below.\n>> You can delete any lines you don't wish to share.\n>>\n>>\n>> [System Info]\n>> git version:\n>> git version 2.35.1\n>> cpu: x86_64\n>> no commit associated with this build\n>> sizeof-long: 8\n>> sizeof-size_t: 8\n>> shell-path: /bin/sh\n>> uname: Linux 5.16.0-4-amd64 #1 SMP PREEMPT Debian 5.16.12-1 (2022-03-08)\n>> x86_64\n>> compiler info: gnuc: 11.2\n>> libc info: glibc: 2.33\n>> $SHELL (typically, interactive shell): /usr/bin/zsh\n> \n> This appears to fix it, but I didn't have time to further validate it,\n> come up with a test etc:\n> \n> diff --git a/builtin/show-branch.c b/builtin/show-branch.c\n> index 330b0553b9d..be3890b2dd6 100644\n> --- a/builtin/show-branch.c\n> +++ b/builtin/show-branch.c\n> @@ -881,10 +881,9 @@ int cmd_show_branch(int ac, const char **av, const char *prefix)\n>  \t\t\t\t       get_color_reset_code(), ref_name[i]);\n>  \t\t\t}\n>  \n> -\t\t\tif (!reflog) {\n> +\t\t\tif (!reflog || !reflog_msg[i])\n>  \t\t\t\t/* header lines never need name */\n>  \t\t\t\tshow_one_commit(rev[i], 1);\n> -\t\t\t}\n>  \t\t\telse\n>  \t\t\t\tputs(reflog_msg[i]);\n>  \n> \n\n-- \nGregory David\nSecurity Engineer\nhttps://www.p1sec.com"},{"id":"453517","messageId":"220413.86wnfses7c.gmgdl@evledraar.gmail.com","threadId":"57722","inReplyTo":"6d510d78-9b0b-c463-889b-cd3855ccdd1b@p1sec.com","subject":"Re: bugreport - SEGFAULT on 'git show-branch --current --reflog=3'","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2022-04-13T18:46:01Z","receivedAt":"2022-04-13T18:47:24Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Wed, Apr 13 2022, Gregory David wrote:\n\n> [[PGP Signed Part:Undecided]]\n> Thanks a lot Aevar!\n>\n> Don't you mean this:\n>\n> diff --git a/builtin/show-branch.c b/builtin/show-branch.c\n> index 330b0553b9..2a5c31729d 100644\n> --- a/builtin/show-branch.c\n> +++ b/builtin/show-branch.c\n> @@ -881,7 +881,7 @@ int cmd_show_branch(int ac, const char **av, const\n> char *prefix)\n>                                        get_color_reset_code(), ref_name[i]);\n>                         }\n>\n> -                       if (!reflog) {\n> +                       if (!reflog || !rev[i]) {\n>                                 /* header lines never need name */\n>                                 show_one_commit(rev[i], 1);\n\nNo, but my \"suggested\" fix was just enough to compile and get past the\nsegfault, i.e. we don't reach the puts(reflog_msg[i]) branch, but of\ncourse rev[i] may be NULL too, I didn't check.\n\nFor this one though: I haven't tried it, but reading show_one_commit()\none of the first things we do is dereference the 1st argument, so surely\nthat will segfault too...\n"},{"id":"453636","messageId":"d72ac546-7c0d-6b05-5b8b-0c4b96192135@p1sec.com","threadId":"57722","inReplyTo":"220413.86wnfses7c.gmgdl@evledraar.gmail.com","subject":"Re: bugreport - SEGFAULT on 'git show-branch --current --reflog=3'","fromName":"Gregory David","fromEmail":"gregory.david@p1sec.com","sentAt":"2022-04-14T07:20:21Z","receivedAt":"2022-04-14T07:20:32Z","isPatch":false,"sender":{"key":"gregory.david@p1sec.com","avatar":"https://gravatar.com/avatar/4fdf1717095ab69bdb7ecf30c8f0efdf273e91591f65b043562a93b27239a944?d=mp&s=160"},"body":"By my side, your first suggestion didn't remove the segfault due to the\nirrelevant check on 'reflog[i]' that is not use on next line, so unable\nto segfault. The fact is you pointed the exact place where it happens\nand my fix of your fix :) remove the segfault.\n\nOn 13/04/2022 18:46, Ævar Arnfjörð Bjarmason wrote:\n> \n> On Wed, Apr 13 2022, Gregory David wrote:\n> \n>> [[PGP Signed Part:Undecided]]\n>> Thanks a lot Aevar!\n>>\n>> Don't you mean this:\n>>\n>> diff --git a/builtin/show-branch.c b/builtin/show-branch.c\n>> index 330b0553b9..2a5c31729d 100644\n>> --- a/builtin/show-branch.c\n>> +++ b/builtin/show-branch.c\n>> @@ -881,7 +881,7 @@ int cmd_show_branch(int ac, const char **av, const\n>> char *prefix)\n>>                                        get_color_reset_code(), ref_name[i]);\n>>                         }\n>>\n>> -                       if (!reflog) {\n>> +                       if (!reflog || !rev[i]) {\n>>                                 /* header lines never need name */\n>>                                 show_one_commit(rev[i], 1);\n> \n> No, but my \"suggested\" fix was just enough to compile and get past the\n> segfault, i.e. we don't reach the puts(reflog_msg[i]) branch, but of\n> course rev[i] may be NULL too, I didn't check.\n> \n> For this one though: I haven't tried it, but reading show_one_commit()\n> one of the first things we do is dereference the 1st argument, so surely\n> that will segfault too...\n\n-- \nGregory David\nSecurity Engineer\nhttps://www.p1sec.com"},{"id":"453640","messageId":"1e5d4562-8fa2-431f-fc8b-ecdddff640cd@p1sec.com","threadId":"57722","inReplyTo":"220413.86wnfses7c.gmgdl@evledraar.gmail.com","subject":"Re: bugreport - SEGFAULT on 'git show-branch --current --reflog=3'","fromName":"Gregory David","fromEmail":"gregory.david@p1sec.com","sentAt":"2022-04-14T07:40:40Z","receivedAt":"2022-04-14T07:40:51Z","isPatch":false,"sender":{"key":"gregory.david@p1sec.com","avatar":"https://gravatar.com/avatar/4fdf1717095ab69bdb7ecf30c8f0efdf273e91591f65b043562a93b27239a944?d=mp&s=160"},"body":"Sorry, my last answer is totally garbage.\n\nOn 13/04/2022 18:46, Ævar Arnfjörð Bjarmason wrote:\n> \n> On Wed, Apr 13 2022, Gregory David wrote:\n> \n>> [[PGP Signed Part:Undecided]]\n>> Thanks a lot Aevar!\n>>\n>> Don't you mean this:\n>>\n>> diff --git a/builtin/show-branch.c b/builtin/show-branch.c\n>> index 330b0553b9..2a5c31729d 100644\n>> --- a/builtin/show-branch.c\n>> +++ b/builtin/show-branch.c\n>> @@ -881,7 +881,7 @@ int cmd_show_branch(int ac, const char **av, const\n>> char *prefix)\n>>                                        get_color_reset_code(), ref_name[i]);\n>>                         }\n>>\n>> -                       if (!reflog) {\n>> +                       if (!reflog || !rev[i]) {\n>>                                 /* header lines never need name */\n>>                                 show_one_commit(rev[i], 1);\n> \n> No, but my \"suggested\" fix was just enough to compile and get past the\n> segfault, i.e. we don't reach the puts(reflog_msg[i]) branch, but of\n> course rev[i] may be NULL too, I didn't check.\n> \n> For this one though: I haven't tried it, but reading show_one_commit()\n> one of the first things we do is dereference the 1st argument, so surely\n> that will segfault too...\n\n-- \nGregory David\nSecurity Engineer\nhttps://www.p1sec.com"}]}