{"thread":{"id":"9853","subject":"[RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array","startedAt":"2007-09-14T22:59:53Z","lastAt":"2007-09-14T23:43:15Z","messageCount":3,"participants":["Shawn O. Pearce","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":2},"messages":[{"id":"53080","messageId":"20070914225953.GC16512@spearce.org","threadId":"9853","inReplyTo":null,"subject":"[RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2007-09-14T22:59:53Z","receivedAt":"2007-09-14T22:59:53Z","isPatch":true,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"A long time ago Junio added this line to always ensure that the\noutput array created by remove_duplicates() had a NULL as its\nterminating node.  Today none of the downstream consumers of this\narray care about a NULL terminator; they only pay attention to the\nsize of the array (as indicated by nr_heads).  In (nearly?) all\ncases passing a NULL element will cause SIGSEGV failures.  So this\nNULL terminal is not actually necessary.\n\nUnfortunately we cannot continue to NULL terminate the array at\nthis point as the array may only have been allocated large enough\nto match the input of nr_heads.  If there are no duplicates than\nwe would be trying to store NULL into heads[nr_heads] and that may\nbe outside of the array.\n\nMy recent series to cleanup builtin-fetch changed the allocation of\nthe heads array from 256 entries to exactly nr_heads thus ensuring\nwe were always overstepping the array and causing memory corruption.\n\nSigned-off-by: Shawn O. Pearce <spearce@spearce.org>\n---\n\n *** RESEND TO CORRECT FROM+SBO ***\n\n Sorry Junio.  I realized too late that the headers were wrong.\n That's what I get for not configuring ~/.gitconfig on my amd64\n Linux box.  ;-)\n\n builtin-fetch-pack.c |    1 -\n 1 files changed, 0 insertions(+), 1 deletions(-)\n\ndiff --git a/builtin-fetch-pack.c b/builtin-fetch-pack.c\nindex b0936cc..2977a94 100644\n--- a/builtin-fetch-pack.c\n+++ b/builtin-fetch-pack.c\n@@ -654,7 +654,6 @@ static int remove_duplicates(int nr_heads, char **heads)\n \t\t\theads[dst] = heads[src];\n \t\tdst++;\n \t}\n-\theads[dst] = 0;\n \treturn dst;\n }\n \n-- \n1.5.3.1.921.g8c3b\n"},{"id":"53081","messageId":"20070914231441.GW3099@spearce.org","threadId":"9853","inReplyTo":"20070914225953.GC16512@spearce.org","subject":"Re: [RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2007-09-14T23:14:41Z","receivedAt":"2007-09-14T23:14:41Z","isPatch":true,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"\"Shawn O. Pearce\" <spearce@spearce.org> wrote:\n> Unfortunately we cannot continue to NULL terminate the array at\n> this point as the array may only have been allocated large enough\n> to match the input of nr_heads.  If there are no duplicates than\n> we would be trying to store NULL into heads[nr_heads] and that may\n> be outside of the array.\n...\n> diff --git a/builtin-fetch-pack.c b/builtin-fetch-pack.c\n> index b0936cc..2977a94 100644\n> --- a/builtin-fetch-pack.c\n> +++ b/builtin-fetch-pack.c\n> @@ -654,7 +654,6 @@ static int remove_duplicates(int nr_heads, char **heads)\n>  \t\t\theads[dst] = heads[src];\n>  \t\tdst++;\n>  \t}\n> -\theads[dst] = 0;\n>  \treturn dst;\n>  }\n>  \n\nThis fortunately does not appear to be a bug in `maint`, `master`,\nor `next`.  It appears to be isolated to the builtin-fetch topic.\nThe builtin-fetch topic changed fetch-pack to be builtin-fetch-pack\nand in doing so changed things such that the heads array might not\nhave room for this final entry.\n\nIn maint/master/next the heads array is actually backed by the\nargv passed into main by the kernel, and that does have an existing\nNULL terminator, which the above \"heads[dst] = 0\" is simply going\nto overwrite if \"heads == nr_heads\".\n\n-- \nShawn.\n"},{"id":"53083","messageId":"7vr6l095kc.fsf@gitster.siamese.dyndns.org","threadId":"9853","inReplyTo":"20070914225953.GC16512@spearce.org","subject":"Re: [RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2007-09-14T23:43:15Z","receivedAt":"2007-09-14T23:43:15Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Shawn O. Pearce\" <spearce@spearce.org> writes:\n\n>  *** RESEND TO CORRECT FROM+SBO ***\n>\n>  Sorry Junio.  I realized too late that the headers were wrong.\n>  That's what I get for not configuring ~/.gitconfig on my amd64\n>  Linux box.  ;-)\n\nActually this might have been a good thing, according to Linus.\nIt is an evidence that you built and tested that change on the\n\"blink\" box not your usual box.\n"}]}