git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v2] rerere: fix crash during clear

From
Marcel Röthke <marcel@roethke.info>
Date
Feb 18, 2024, 19:46 UTC
Message-ID
<20240218194603.1210895-1-marcel@roethke.info>
In-Reply-To
<20240218114936.1121077-1-marcel@roethke.info>

When rerere_clear is called, for instance when aborting a rebase, and the current conflict does not have a pre or postimage recorded git crashes with a SEGFAULT in has_rerere_resolution when accessing the status member of struct rerere_dir. This happens because scan_rerere_dir only allocates the status field in struct rerere_dir when a post or preimage was found. In some cases a segfault may happen even if a post or preimage was recorded if it was not for the variant of interest and the number of the variant that is present is lower than the variant of interest.

Solve this by making sure the status field is large enough to accommodate for the variant of interest so it can be accessed without checking if it is large enough.

An alternative solution would be to always check before accessing the status field, but I think the chosen solution aligns better with the assumptions made elsewhere in the code.

Signed-off-by: Marcel Röthke <marcel@roethke.info>
---
Range-diff against v1:
1:  93f982d170 ! 1:  68178298fe rerere: fix crash in during clear
    @@ Metadata
     Author: Marcel Röthke <marcel@roethke.info>
     
      ## Commit message ##
    -    rerere: fix crash in during clear
    +    rerere: fix crash during clear
     
         When rerere_clear is called, for instance when aborting a rebase, and
         the current conflict does not have a pre or postimage recorded git
    @@ Commit message
         the number of the variant that is present is lower than the variant of
         interest.
     
    -    This patch solves this by making sure the status field is large enough
    -    to accommodate for the variant of interest so it can be accesses without
    +    Solve this by making sure the status field is large enough to
    +    accommodate for the variant of interest so it can be accessed without
         checking if it is large enough.
     
         An alternative solution would be to always check before accessing the
    @@ rerere.c: static void read_rr(struct repository *r, struct string_list *rr)
      		buf.buf[hexsz] = '\0';
      		id = new_rerere_id_hex(buf.buf);
      		id->variant = variant;
    -+		/* make sure id->collection->status has enough space
    -+		 * for the variant we are interested in */
    ++		/*
    ++		 * make sure id->collection->status has enough space
    ++		 * for the variant we are interested in
    ++		 */
     +		fit_variant(id->collection, variant);
      		string_list_insert(rr, path)->util = id;
      	}
 rerere.c | 5 +++++
 1 file changed, 5 insertions(+)
diff --git a/rerere.c b/rerere.c
index ca7e77ba68..4683d6cbb1 100644
--- a/rerere.c
+++ b/rerere.c
@@ -219,6 +219,11 @@ static void read_rr(struct repository *r, struct string_list *rr)
 		buf.buf[hexsz] = '\0';
 		id = new_rerere_id_hex(buf.buf);
 		id->variant = variant;
+		/*
+		 * make sure id->collection->status has enough space
+		 * for the variant we are interested in
+		 */
+		fit_variant(id->collection, variant);
 		string_list_insert(rr, path)->util = id;
 	}
 	strbuf_release(&buf);
-- 
2.43.2
Previous: Marcel RöthkeNext: Junio C Hamano
Message 4 of 15 in “rerere: fix crash in during clear”
  1. rerere: fix crash in during clearMarcel Röthke, Feb 18, 2024
  2. Kristoffer HaugsbakkFeb 18, 2024
  3. Marcel RöthkeFeb 18, 2024
  4. rerere: fix crash during clearMarcel Röthke, Feb 18, 2024
  5. Junio C HamanoFeb 20, 2024
  6. Marcel RöthkeFeb 24, 2024
  7. Junio C HamanoMar 24, 2024
  8. Marcel RöthkeMar 25, 2024
  9. Marcel RöthkeApr 7, 2024
  10. Junio C HamanoApr 8, 2024
  11. rerere: fix crashes due to unmatched opening conflict markersMarcel Röthke, Apr 9, 2024
  12. Junio C HamanoApr 12, 2024
  13. Junio C HamanoApr 15, 2024
  14. Marcel RöthkeApr 16, 2024
  15. rerere: fix crashes due to unmatched opening conflict markersMarcel Röthke, Apr 16, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.