Re: git 2.2.2 annotate crash (strbuf.c:32)

From: Jeff King <peff@peff.net>
Date: Feb 9, 2015, 01:28 UTC
Message-ID: <20150209012858.GB21072@peff.net>
In-Reply-To: <54D7D634.2050807@aegee.org>

On Sun, Feb 08, 2015 at 10:33:40PM +0100, Dilyan Palauzov wrote:

> I use git 2.2.2 and on my system git annotate crashed with the following
> log.

I couldn't reproduce it with a few simple examples. Is it possible for you to show us the repository and command that caused this?

Show 13 quoted lines

> (gdb) bt full
> #0  0x00007fe420649655 in raise () from /lib64/libc.so.6
> No symbol table info available.
> #1  0x00007fe42064aad8 in abort () from /lib64/libc.so.6
> No symbol table info available.
> #2  0x00007fe42068928b in __libc_message () from /lib64/libc.so.6
> No symbol table info available.
> #3  0x00007fe42068ee36 in malloc_printerr () from /lib64/libc.so.6
> No symbol table info available.
> #4  0x00007fe42068fbb3 in _int_free () from /lib64/libc.so.6
> No symbol table info available.
> #5  0x000000000041335a in strbuf_release (sb=0x7fff44797480) at strbuf.c:32
>         sb = 0x7fff44797480

So presumably the sb->buf we pass to free() is not valid. Given the address of the strbuf, and the address of the commit_info here:

> #6  commit_info_destroy (ci=0x7fff447973e0) at builtin/blame.c:1646
> No locals.

we are at offset 160, which is almost certainly the ci->summary strbuf. Which is:

Show 5 quoted lines

>           summary = {
>             alloc = 26,
>             len = 25,
>             buf = 0xe05b50 <incomplete sequence \330>
>           }

The alloc/len look reasonable, but the buffer looks odd (it should probably have some actual text in it). I don't see anywhere in the code that we assign to that buffer or do anything questionable, though. We just strbuf_add and then eventually strbuf_release it. You cannot even get into this situation by calling strbuf_release twice, as it sets the pointer to a known value after it is freed.

-Peff