Re: [BUG] rebase: can write reflog with uninit. `action` string

From: Jeff King <peff@peff.net>
Date: Apr 29, 2025, 21:51 UTC
Message-ID: <20250429215155.GA36727@coredump.intra.peff.net>
In-Reply-To: <fbc97d6a-2022-4a64-a2ba-5a7255cd81a6@app.fastmail.com>

On Tue, Apr 29, 2025 at 09:40:13PM +0200, Kristoffer Haugsbakk wrote:

Show 13 quoted lines

> On Tue, Apr 29, 2025, at 11:22, Phillip Wood wrote:
> >> #0  run_git_commit (defmsg=0x555555babe70 "<repo path>/MERGE_MSG", opts=0x7fffffffc070, flags=0) at sequencer.c:1158
> >
> > Thanks for the backtrace. It would be useful to know what's stored in
> > opts->ctx->reflog_message at this point if it's not too much trouble
> > please can you run "print *opts" and "print *opts->ctx" here.
> 
> Today I ran on f65182a99e5 (The ninth batch, 2025-04-24) at
> sequencer.c:1148.  I was never able to reproduce this
> `opts->ctx->reflog_message` having a weird value with GDB today.  The
> reflog was also fine.
> 
> Then I ran without GDB and I got the weird reflog that I expected.

Have you tried building with "make SANITIZE=address,undefined"?

This is a wild guess, but since ctx->reflog_message is pointing to a static strbuf, it could be a use after free if the strbuf is reallocated due to another call to reflog_message(), but we are still holding the old pointer via ctx->reflog_message.

-Peff