[PATCH] commit: check result of resolve_ref_unsafe

From: Andrey Okoshkin <a.okoshkin@samsung.com>
Date: Oct 18, 2017, 17:00 UTC
Message-ID: <0e396c24-167f-901e-9122-cdc17164ec1e@samsung.com>
In-Reply-To: <CGME20171018170047epcas2p4310be357e11e194d6d08ac3bdc478ba3@epcas2p4.samsung.com>

Add check of the resolved HEAD reference while printing of a commit summary. resolve_ref_unsafe() may return NULL pointer if underlying calls of lstat() or open() fail in files_read_raw_ref(). Such situation can be caused by race: file becomes inaccessible to this moment.

Signed-off-by: Andrey Okoshkin <a.okoshkin@samsung.com>
---
Hello,
I've injected a fault to git binary with the internal tool for fault tolerance
evaluation.

lstat() or open() calls return '-1', errno is set to 'EACCES': #0 0x6559a4 in files_read_raw_ref refs/files-backend.c:686 #1 0x642816 in refs_read_raw_ref /home/tesla/devel/repos/git/refs.c:1392 #2 0x642a69 in refs_resolve_ref_unsafe /home/tesla/devel/repos/git/refs.c:1431 #3 0x6443ce in resolve_ref_unsafe /home/tesla/devel/repos/git/refs.c:1483 #4 0x44822e in print_summary builtin/commit.c:1485 #5 0x44822e in cmd_commit builtin/commit.c:1817 #6 0x4084f5 in run_builtin /home/tesla/devel/repos/git/git.c:342 #7 0x4084f5 in handle_builtin /home/tesla/devel/repos/git/git.c:550 #8 0x40997b in run_argv /home/tesla/devel/repos/git/git.c:602 #9 0x40997b in cmd_main /home/tesla/devel/repos/git/git.c:679 #10 0x408087 in main /home/tesla/devel/repos/git/common-main.c:43

As a result git crashes silently with SIGSEGV at 'strcmp(head, "HEAD")': #0 0x447c16 in print_summary builtin/commit.c:1486 #1 0x447c16 in cmd_commit builtin/commit.c:1817 #2 0x4084f5 in run_builtin /home/tesla/devel/repos/git/git.c:342 #3 0x4084f5 in handle_builtin /home/tesla/devel/repos/git/git.c:550 #4 0x40997b in run_argv /home/tesla/devel/repos/git/git.c:602 #5 0x40997b in cmd_main /home/tesla/devel/repos/git/git.c:679 #6 0x408087 in main /home/tesla/devel/repos/git/common-main.c:43

It seems that in a real life it's very difficult to reproduce such behaviour because the readability of '.git' directory is checked before. But still the NULL pointer result returned by resolve_ref_unsafe() is not checked anyhow. That's why I'm not sure whether it's a bug or not.

Best regards, Andrey

 builtin/commit.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/builtin/commit.c b/builtin/commit.c
index 1a0da71a4..71a58dea3 100644
--- a/builtin/commit.c
+++ b/builtin/commit.c
@@ -1483,6 +1483,8 @@ static void print_summary(const char *prefix, const struct object_id *oid,
 	diff_setup_done(&rev.diffopt);
 
 	head = resolve_ref_unsafe("HEAD", 0, junk_oid.hash, NULL);
+	if (!head)
+		BUG("unable to resolve HEAD reference");
 	if (!strcmp(head, "HEAD"))
 		head = _("detached HEAD");
 	else

-- 
2.14.2