{"thread":{"id":"62350","subject":"Unitialised pointer free in is_crontab_available","startedAt":"2024-10-17T06:48:42Z","lastAt":"2024-10-17T08:38:42Z","messageCount":3,"participants":["Dima Tisnek","Eric Sunshine","Kristoffer Haugsbakk"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"505343","messageId":"CAGGBzXLN6eFZmgEE=KBp9vbcgYGGEbDJDUrfyVeYjuCrRiYcXA@mail.gmail.com","threadId":"62350","inReplyTo":null,"subject":"Unitialised pointer free in is_crontab_available","fromName":"Dima Tisnek","fromEmail":"dimaqq@gmail.com","sentAt":"2024-10-17T06:48:30Z","receivedAt":"2024-10-17T06:48:42Z","isPatch":false,"sender":{"key":"dimaqq@gmail.com","avatar":null},"body":"Here's the code:\n\nstatic int is_crontab_available(void)\n{\nchar *cmd;\nint is_available;\nint ret;\n\nif (get_schedule_cmd(\"crontab\", &is_available, &cmd)) {\nret = is_available;\ngoto out;\n}\n\n#ifdef __APPLE__\n/*\n* macOS has cron, but it requires special permissions and will\n* create a UI alert when attempting to run this command.\n*/\nret = 0;\n#else\nret = check_crontab_process(cmd);\n#endif\n\nout:\nfree(cmd);\nreturn ret;\n}\n\n\nThis code will try to `free(cmd)` even if get_schedule_cmd returned 0,\nwhen it's safe to assume that &cmd was not allocated.\n\n\nstatic int get_schedule_cmd(const char *cmd, int *is_available, char **out)\n{\nchar *testing = xstrdup_or_null(getenv(\"GIT_TEST_MAINT_SCHEDULER\"));\nstruct string_list_item *item;\nstruct string_list list = STRING_LIST_INIT_NODUP;\n\nif (!testing)\nreturn 0;\n\n[rest snipped]\n\n\nIf I read this right, as long as the special env var is not set, this\nfunction returns 0 and does not populate *out.\n\n\nReproduce:\nrun `git maintenance start` on a mac in some git repo\n\nTested with:\nmacos Darwin 24.0.0\narm64\nhomebrew git 2.47.0\n\n\n\nc/cpython (main)> lldb (which git)\n(lldb) target create \"/opt/homebrew/bin/git\"\nCurrent executable set to '/opt/homebrew/bin/git' (arm64).\n(lldb) b malloc_error_break\nBreakpoint 1: where = libsystem_malloc.dylib`malloc_error_break,\naddress = 0x00000001802861bc\n(lldb) run maintenance start\nProcess 35052 launched: '/opt/homebrew/bin/git' (arm64)\ngit(35052,0x1ec22b240) malloc: *** error for object 0x1: pointer being\nfreed was not allocated\ngit(35052,0x1ec22b240) malloc: *** set a breakpoint in\nmalloc_error_break to debug\nProcess 35052 stopped\n* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1\n    frame #0: 0x00000001879221bc libsystem_malloc.dylib`malloc_error_break\nlibsystem_malloc.dylib`malloc_error_break:\n->  0x1879221bc <+0>:  pacibsp\n    0x1879221c0 <+4>:  stp    x29, x30, [sp, #-0x10]!\n    0x1879221c4 <+8>:  mov    x29, sp\n    0x1879221c8 <+12>: nop\nTarget 0: (git) stopped.\n(lldb) bt\n* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1\n  * frame #0: 0x00000001879221bc libsystem_malloc.dylib`malloc_error_break\n    frame #1: 0x00000001879015e8 libsystem_malloc.dylib`malloc_vreport + 748\n    frame #2: 0x000000018790523c libsystem_malloc.dylib`malloc_report + 64\n    frame #3: 0x000000018792326c libsystem_malloc.dylib`find_zone_and_free + 528\n    frame #4: 0x000000010004fa78 git`is_crontab_available + 56\n    frame #5: 0x000000010004f974 git`update_background_schedule + 168\n    frame #6: 0x000000010004e1dc git`maintenance_start + 248\n    frame #7: 0x000000010004d9b4 git`cmd_maintenance + 336\n    frame #8: 0x0000000100005678 git`run_builtin + 396\n    frame #9: 0x0000000100004b48 git`handle_builtin + 324\n    frame #10: 0x00000001000043c0 git`cmd_main + 788\n    frame #11: 0x00000001000c141c git`main + 236\n    frame #12: 0x0000000187768274 dyld`start + 2840\n(lldb) frame select 4\nframe #4: 0x000000010004fa78 git`is_crontab_available + 56\ngit`is_crontab_available:\n->  0x10004fa78 <+56>: mov    x0, x19\n    0x10004fa7c <+60>: ldp    x29, x30, [sp, #0x20]\n    0x10004fa80 <+64>: ldp    x20, x19, [sp, #0x10]\n    0x10004fa84 <+68>: add    sp, sp, #0x30\n(lldb) disassemble -n is_crontab_available\ngit`is_crontab_available:\n    0x10004fa40 <+0>:  sub    sp, sp, #0x30\n    0x10004fa44 <+4>:  stp    x20, x19, [sp, #0x10]\n    0x10004fa48 <+8>:  stp    x29, x30, [sp, #0x20]\n    0x10004fa4c <+12>: add    x29, sp, #0x20\n    0x10004fa50 <+16>: adrp   x0, 535\n    0x10004fa54 <+20>: add    x0, x0, #0x3f ; \"crontab\"\n    0x10004fa58 <+24>: add    x1, sp, #0x4\n    0x10004fa5c <+28>: add    x2, sp, #0x8\n    0x10004fa60 <+32>: bl     0x100050300    ; get_schedule_cmd\n    0x10004fa64 <+36>: ldr    w8, [sp, #0x4]\n    0x10004fa68 <+40>: cmp    w0, #0x0\n    0x10004fa6c <+44>: csel   w19, wzr, w8, eq\n    0x10004fa70 <+48>: ldr    x0, [sp, #0x8]\n    0x10004fa74 <+52>: bl     0x100249170    ; symbol stub for: free\n->  0x10004fa78 <+56>: mov    x0, x19\n    0x10004fa7c <+60>: ldp    x29, x30, [sp, #0x20]\n    0x10004fa80 <+64>: ldp    x20, x19, [sp, #0x10]\n    0x10004fa84 <+68>: add    sp, sp, #0x30\n    0x10004fa88 <+72>: ret\n"},{"id":"505344","messageId":"CAPig+cTNUNCftpr28F6USxVDm-2UZt+x9NxHJ+zbX3Daf5thBg@mail.gmail.com","threadId":"62350","inReplyTo":"CAGGBzXLN6eFZmgEE=KBp9vbcgYGGEbDJDUrfyVeYjuCrRiYcXA@mail.gmail.com","subject":"Re: Unitialised pointer free in is_crontab_available","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2024-10-17T06:57:02Z","receivedAt":"2024-10-17T06:57:15Z","isPatch":false,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Thu, Oct 17, 2024 at 2:48 AM Dima Tisnek <dimaqq@gmail.com> wrote:\n> This code will try to `free(cmd)` even if get_schedule_cmd returned 0,\n> when it's safe to assume that &cmd was not allocated.\n>\n> If I read this right, as long as the special env var is not set, this\n> function returns 0 and does not populate *out.\n>\n> Reproduce:\n> run `git maintenance start` on a mac in some git repo\n\nDoes [1] resolve the problem for you?\n\n[1]: https://lore.kernel.org/git/a5b1433abfd84cb627efc17f52e0d644ee207bb0.1728538282.git.ps@pks.im/\n"},{"id":"505347","messageId":"8575821f-20b9-4c94-b0ab-bb2ac7c351b7@app.fastmail.com","threadId":"62350","inReplyTo":"CAPig+cTNUNCftpr28F6USxVDm-2UZt+x9NxHJ+zbX3Daf5thBg@mail.gmail.com","subject":"Re: Unitialised pointer free in is_crontab_available","fromName":"Kristoffer Haugsbakk","fromEmail":"kristofferhaugsbakk@fastmail.com","sentAt":"2024-10-17T08:38:20Z","receivedAt":"2024-10-17T08:38:42Z","isPatch":false,"sender":{"key":"kristofferhaugsbakk@fastmail.com","avatar":null},"body":"> Unitialised pointer free in is_crontab_available\n> […]\n> Reproduce:\n> run `git maintenance start` on a mac in some git repo\n\nI think it’s useful to start in the subject and the opening paragraphs\nwith the user-visible bug and then go into the concrete code.\nPresumably\n\n    `git maintenance start` segfaults on macOS\n\nAssuming that’s how you found the bug.\n\nWhen I saw the subject I suspected (before I saw Eric’s email) that it\nwas about that `git maintenance start` regression.  Because crontab\nsounds like something that git-maintance(1) would care about.  But that\nwas the only hint I think.\n\nOn Thu, Oct 17, 2024, at 08:57, Eric Sunshine wrote:\n> […]\n"}]}