Re: git-http-fetch segfault, curl 7.18.0

From: Mike Hommey <mh@glandium.org>
Date: Mar 2, 2008, 20:03 UTC
Message-ID: <20080302200309.GA2070@glandium.org>
In-Reply-To: <20080302192355.GA625@glandium.org>

On Sun, Mar 02, 2008 at 08:23:55PM +0100, Mike Hommey wrote:

Show 28 quoted lines

> On Sun, Mar 02, 2008 at 07:08:57PM +0000, Gerrit Pape wrote:
> > Hi, as reported through http://bugs.debian.org/468836, I can reproduce
> > with current maint branch on Debian/unstable, but I don't know whether
> > it's a problem in curl, or in git.  Maybe anyone with some experience
> > in curl can help on this?
> > 
> > gdb gives this
> (...)
> 
> valgrind gives better insight:
> ==862== Invalid read of size 4
> ==862==    at 0x493B32: fill_active_slots (http.c:441)
> ==862==    by 0x493CF9: step_active_slots (http.c:459)
> ==862==    by 0x493D6E: run_active_slot (http.c:479)
> ==862==    by 0x493F8B: http_cleanup (http.c:296)
> ==862==    by 0x494CA8: cleanup (http-walker.c:900)
> ==862==    by 0x4911D6: walker_free (walker.c:315)
> ==862==    by 0x44A149: cmd_http_fetch (builtin-http-fetch.c:81)
> ==862==    by 0x404247: handle_internal_command (git.c:248)
> ==862==    by 0x4049D4: main (git.c:412)
> ==862==  Address 0x7c7c558 is 16 bytes inside a block of size 72 free'd
> ==862==    at 0x4C20B2E: free (vg_replace_malloc.c:323)
> ==862==    by 0x493F47: http_cleanup (http.c:301)
> ==862==    by 0x494CA8: cleanup (http-walker.c:900)
> ==862==    by 0x4911D6: walker_free (walker.c:315)
> ==862==    by 0x44A149: cmd_http_fetch (builtin-http-fetch.c:81)
> ==862==    by 0x404247: handle_internal_command (git.c:248)
> ==862==    by 0x4049D4: main (git.c:412)

(...)

> 
> It seems there is something wrong going on with slots...

And the problem lies in the fact we run_active_slot() during cleanup, which can end up going through all the slots starting at active_queue_head, while we have freed the first slots...

Now, why do we need to run slots when cleaning up ?

Mike