{"thread":{"id":"63030","subject":"Subject: Null pointer dereference vulnerability in src/read-cache.h","startedAt":"2025-03-01T06:43:59Z","lastAt":"2025-03-01T12:47:21Z","messageCount":2,"participants":["H Z","René Scharfe"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"513320","messageId":"CAAJd+faaEsTVqfTH=EsjXu8kneP1ZAASCCoaqp9zuODjSnDatw@mail.gmail.com","threadId":"63030","inReplyTo":null,"subject":"Subject: Null pointer dereference vulnerability in src/read-cache.h","fromName":"H Z","fromEmail":"shiyuyuranzh@gmail.com","sentAt":"2025-03-01T06:43:46Z","receivedAt":"2025-03-01T06:43:59Z","isPatch":false,"sender":{"key":"shiyuyuranzh@gmail.com","avatar":null},"body":"Hi, I am a static analysis tool developer, and I have found a\npotential null pointer dereference bug in src/read-cache.h and would\nlike to report it to the maintainers. This vulnerability has the\npotential to cause unexpected application behavior, crashes. Can you\nplease help me check it? Thank you for your effort and patience!\n\nBelow is the execution sequence of the program that may produce the\nnull pointer dereference bug.\n\nBelow is the execution sequence of the program that may produce the bug.\nFirst, in the file diff-lib.c, the function oneway_diff assigns tree\nto NULL on line 537.\nSecond, if on line 540, idx ? idx : tree conditional judgement is\nfalse, tree, which is NULL, is passed as the 2nd argument to the\nfunction ce_path_match.\nThird, in file read-cache.h, the parameter ce of function\nce_path_match is assigned to NULL. and ce is dereferenced on line 41,\nresulting in a null pointer dereference vulnerability.\n\nThank you for reviewing this report. I look forward to your response.\n"},{"id":"513333","messageId":"6ab668ba-0293-4afc-944f-9bd1299110b5@web.de","threadId":"63030","inReplyTo":"CAAJd+faaEsTVqfTH=EsjXu8kneP1ZAASCCoaqp9zuODjSnDatw@mail.gmail.com","subject":"Re: Subject: Null pointer dereference vulnerability in src/read-cache.h","fromName":"René Scharfe","fromEmail":"l.s.r@web.de","sentAt":"2025-03-01T12:47:19Z","receivedAt":"2025-03-01T12:47:21Z","isPatch":false,"sender":{"key":"l.s.r@web.de","avatar":"https://avatars.githubusercontent.com/u/26122331?v=4"},"body":"Am 01.03.25 um 07:43 schrieb H Z:\n> Hi, I am a static analysis tool developer, and I have found a\n> potential null pointer dereference bug in src/read-cache.h and would\n> like to report it to the maintainers. This vulnerability has the\n> potential to cause unexpected application behavior, crashes. Can you\n> please help me check it? Thank you for your effort and patience!\n>\n> Below is the execution sequence of the program that may produce the\n> null pointer dereference bug.\n>\n> Below is the execution sequence of the program that may produce the bug.\n> First, in the file diff-lib.c, the function oneway_diff assigns tree\n> to NULL on line 537.\n\nContext:\n\n\tconst struct cache_entry *idx = src[0];\n\tconst struct cache_entry *tree = src[1];\n\n\t/*\n\t * Unpack-trees generates a DF/conflict entry if\n\t * there was a directory in the index and a tree\n\t * in the tree. From a diff standpoint, that's a\n\t * delete of the tree and a create of the file.\n\t */\n\tif (tree == o->df_conflict_entry)\n\t\ttree = NULL;\n\nWhat's a DF conflict?  A directory (D) in the index and a file (F) in\nthe tree for the same path, or vice versa.  Except that in the object\ndatabase directories are represented by \"trees\" and files by \"blobs\",\nbut that's not important here.\n\nNot sure why \"a tree in the tree\" would conflict with a directory,\nthough, as the comment claims.  Probably a typo, and it should read\n\"a blob in the tree\" instead.\n\n> Second, if on line 540, idx ? idx : tree conditional judgement is\n> false, tree, which is NULL, is passed as the 2nd argument to the\n> function ce_path_match.\n\nThis should never happen, as we don't call a situation where one side\nis absent (i.e. an added or removed file or directory) a DF conflict,\ni.e. (tree == o->df_conflict_entry) and (idx == NULL) should never be\ntrue at the same time.\n\nNow it would be very interesting if that assumption could actually be\nviolated by callers.  That's a bit hard to prove across the indirect\ncall by function pointer, I guess.\n\n> Third, in file read-cache.h, the parameter ce of function\n> ce_path_match is assigned to NULL. and ce is dereferenced on line 41,\n> resulting in a null pointer dereference vulnerability.\n\nWe could add a defensive check, but is it worth it?  If we get it\nwrong we'd get a segfault, at least on our main target platforms.\n\nRené\n\n"}]}