Re: git 2.2.2 annotate crash (strbuf.c:32)

From: Eric Sunshine <sunshine@sunshineco.com>
Date: Feb 9, 2015, 18:46 UTC
Message-ID: <20150209184612.GA4327@flurp.local>
In-Reply-To: <54D88D03.1090501@aegee.org>

On Mon, Feb 09, 2015 at 11:33:39AM +0100, Dilyan Palauzov wrote:

Show 19 quoted lines

> the point is that with exactly the same configuration on one
> computer there is crash and on another one things work just fine.
> 
> I found out that line builtin/blame.c:1675 makes the problems:
> 
> if (len) {
>   printf("blame.c:1676, subject: %s, len: %i\n", subject, len);
> -->  strbuf_add(&ret->summary, subject, len);  <--
> } else
>    strbuf_addf(&ret->summary, "(%s)", sha1_to_hex(commit->object.sha1));
> 
> commenting it out and compiling does not lead to crashing git
> anymore. You can find below the output of printf.
> 
> git clone git://git.cyrusimap.org/cyrus-imapd
> git annotate timsieved/parser.c
> 
> *** Error in `git': double free or corruption (!prev):
> 0x00000000022e4b40 ***

There is a bit of suspicious code in builtin/blame.c where it is destroying the commit_info without ever initializing it, and this happens many times when blaming 'timsieved/parser.c'. Does the following patch fix the problem for you?

--- 8< ---

diff --git a/builtin/blame.c b/builtin/blame.c
index 303e217..a3cc972 100644
--- a/builtin/blame.c
+++ b/builtin/blame.c
@@ -2085,7 +2085,6 @@ static void find_alignment(struct scoreboard *sb, int *option)
 
 	for (e = sb->ent; e; e = e->next) {
 		struct origin *suspect = e->suspect;
-		struct commit_info ci;
 		int num;
 
 		if (compute_auto_abbrev)
@@ -2096,6 +2095,7 @@ static void find_alignment(struct scoreboard *sb, int *option)
 		if (longest_file < num)
 			longest_file = num;
 		if (!(suspect->commit->object.flags & METAINFO_SHOWN)) {
+			struct commit_info ci;
 			suspect->commit->object.flags |= METAINFO_SHOWN;
 			get_commit_info(suspect->commit, &ci, 1);
 			if (*option & OUTPUT_SHOW_EMAIL)
@@ -2104,6 +2104,7 @@ static void find_alignment(struct scoreboard *sb, int *option)
 				num = utf8_strwidth(ci.author.buf);
 			if (longest_author < num)
 				longest_author = num;
+			commit_info_destroy(&ci);
 		}
 		num = e->s_lno + e->num_lines;
 		if (longest_src_lines < num)
@@ -2113,8 +2114,6 @@ static void find_alignment(struct scoreboard *sb, int *option)
 			longest_dst_lines = num;
 		if (largest_score < ent_score(sb, e))
 			largest_score = ent_score(sb, e);
-
-		commit_info_destroy(&ci);
 	}
 	max_orig_digits = decimal_width(longest_src_lines);
 	max_digits = decimal_width(longest_dst_lines);

-- 
2.3.0.rc2.191.g303d43c
--- 8< ---