Re: [BUG REPORT] git fetch --prefetch with incorrect options hangs with 2.47.0

From: Jeff King <peff@peff.net>
Date: Nov 12, 2024, 06:49 UTC
Message-ID: <20241112064951.GA619985@coredump.intra.peff.net>
In-Reply-To: <SA1PR17MB6501281EF202EA694CF9DC03CA582@SA1PR17MB6501.namprd17.prod.outlook.com>

On Mon, Nov 11, 2024 at 10:15:44PM +0000, Eric Mills wrote:

Show 15 quoted lines

> What did you do before the bug happened? (Steps to reproduce your issue)
> I ran `git fetch --prefetch origin main` with git 2.47 on both my
> Windows machine (2.47.windows.2) and my Mac (2.47.0) and it hangs.
> 
> When I downgrade, same command succeeds on
> 2.46.2.Windows.1 / 2.46.2 (macOS).
> [...]
> On Windows, I don't get an error. It hangs indefinitely.
> On macOS, after a few seconds I got the following:
> 
> git(84051,0x20171cf40) malloc: *** error for object 0x600001978390:
> pointer being freed was not allocated
> 
> git(84051,0x20171cf40) malloc: *** set a breakpoint in
> malloc_error_break to debug

Thanks for the report. I see similar heap corruption problems on Linux. Building with ASan shows a double-free:

  ==646934==ERROR: AddressSanitizer: attempting double-free on 0x502000002450 in thread T0:
      #0 0x7f9ab1cf3918 in free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
      #1 0x557a1d8082c2 in refspec_clear /home/peff/compile/git/refspec.c:228
      #2 0x557a1ce92a08 in fetch_one builtin/fetch.c:2136
      #3 0x557a1ce9889d in cmd_fetch builtin/fetch.c:2443
      #4 0x557a1cd2e1ca in run_builtin /home/peff/compile/git/git.c:483
      #5 0x557a1cd2f2d8 in handle_builtin /home/peff/compile/git/git.c:749
      #6 0x557a1cd2fb3a in run_argv /home/peff/compile/git/git.c:819
      #7 0x557a1cd30e66 in cmd_main /home/peff/compile/git/git.c:954
      #8 0x557a1d1370c1 in main /home/peff/compile/git/common-main.c:64
      #9 0x7f9ab1233d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
      #10 0x7f9ab1233e24 in __libc_start_main_impl ../csu/libc-start.c:360
      #11 0x557a1cd27290 in _start (/home/peff/compile/git/git+0x129d290) (BuildId: cca88fc4d05f503e4aecc54e9437a56865d5eca1)

Bisecting on:

  make SANITIZE=address &&
  bin-wrappers/git fetch --prefetch origin master

turns up my ea4780307c (fetch: free "raw" string when shrinking refspec, 2024-09-24). I'll see if I can figure out what's going on.

-Peff