{"thread":{"id":"63031","subject":"Subject: Null pointer dereference vulnerability in commit.c","startedAt":"2025-03-01T07:34:07Z","lastAt":"2025-03-01T15:56:51Z","messageCount":2,"participants":["H Z","René Scharfe"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"513321","messageId":"CAAJd+fZUEo15C29KSk61-P+7x=bjhgQ5iDTdbqV++NY4+iGchA@mail.gmail.com","threadId":"63031","inReplyTo":null,"subject":"Subject: Null pointer dereference vulnerability in commit.c","fromName":"H Z","fromEmail":"shiyuyuranzh@gmail.com","sentAt":"2025-03-01T07:33:55Z","receivedAt":"2025-03-01T07:34:07Z","isPatch":false,"sender":{"key":"shiyuyuranzh@gmail.com","avatar":null},"body":"Hi, I am a static analysis tool developer, and I have found a\npotential null pointer dereference bug in commit.c and would like to\nreport it to the maintainers. This vulnerability has the potential to\ncause unexpected application behavior, crashes. Can you please help me\ncheck it? Thank you for your effort and patience!\n\nBelow is the execution sequence of the program that may produce the\nnull pointer dereference bug.\n\nFirst, in the file commit.c, the function pop_commit may assign item\nto NULL at line 806 if the conditional judgement is false.\nSecond, in file commit.c, function pop_most_recent_commit calls\nfunction pop_commit at line 748, which may cause variable ret to be\nassigned NULL.\nFinally, ret is dereferenced on line 749, leading to a null pointer\ndereference vulnerability.\n\nHowever, in the file merge-ort.c, the function merge_ort_internal\ncalls the function pop_commit on line 5176, and then makes a judgement\non whether the return value of pop_commit is NULL or not on line 5177,\nwhich suggests that it is indeed possible for pop_commit to return\nNULL.\n\nThank you for reviewing this report. I look forward to your response.\n"},{"id":"513339","messageId":"70bab132-1107-4946-8ef9-24c6b0f9d193@web.de","threadId":"63031","inReplyTo":"CAAJd+fZUEo15C29KSk61-P+7x=bjhgQ5iDTdbqV++NY4+iGchA@mail.gmail.com","subject":"Re: Subject: Null pointer dereference vulnerability in commit.c","fromName":"René Scharfe","fromEmail":"l.s.r@web.de","sentAt":"2025-03-01T15:56:48Z","receivedAt":"2025-03-01T15:56:51Z","isPatch":false,"sender":{"key":"l.s.r@web.de","avatar":"https://avatars.githubusercontent.com/u/26122331?v=4"},"body":"Am 01.03.25 um 08:33 schrieb H Z:\n> Hi, I am a static analysis tool developer, and I have found a\n> potential null pointer dereference bug in commit.c and would like to\n> report it to the maintainers. This vulnerability has the potential to\n> cause unexpected application behavior, crashes. Can you please help me\n> check it? Thank you for your effort and patience!\n>\n> Below is the execution sequence of the program that may produce the\n> null pointer dereference bug.\n>\n> First, in the file commit.c, the function pop_commit may assign item\n> to NULL at line 806 if the conditional judgement is false.\n\nTrue.\n\n> Second, in file commit.c, function pop_most_recent_commit calls\n> function pop_commit at line 748, which may cause variable ret to be\n> assigned NULL.\n\nTechnically true, but not quite.  I understand that this is effectively\na trap for analysis tools, unfortunately.  pop_commit() handles empty\ncommit_lists, while pop_most_recent_commit() doesn't, despite its\nsimilar name.  All three callers of the latter make sure to pass only\npointers to non-NULL commit_lists, so we're actually safe.\n\n> Finally, ret is dereferenced on line 749, leading to a null pointer\n> dereference vulnerability.\n>\n> However, in the file merge-ort.c, the function merge_ort_internal\n> calls the function pop_commit on line 5176, and then makes a judgement\n> on whether the return value of pop_commit is NULL or not on line 5177,\n> which suggests that it is indeed possible for pop_commit to return\n> NULL.\n\nTrue.\n\nMost callers of pop_commit() check for NULL, so that function could\nstop checking as well, to slightly increase efficiency and simplicity.\nWe would \"just\" have to audit every caller and make sure they are all\nready for that.  The only ones that need modifying seem to be in\npack-bitmap-write.c and revision.c.  Is it worth it?  Not sure.\n\nRené\n\n"}]}