[PATCH v3] refs/ref-cache: fix SEGFAULT when seeking in empty directories
- From
Karthik Nayak <karthik.188@gmail.com>
- Date
- Oct 1, 2025, 12:17 UTC
- Message-ID
- <20251001-583-git-for-each-ref-start-after-v3-1-000f03837a92@gmail.com>
- In-Reply-To
- <20250924-583-git-for-each-ref-start-after-v1-1-c73be2b5db5a@gmail.com>
The 'cache_ref_iterator_seek()' function is used to seek the `ref_iterator` to the desired reference in the ref-cache mechanism. We use the seeking functionality to implement the '--start-after' flag in 'git-for-each-ref(1)'.
When using the files-backend with packed-refs, it is possible that some of the refs directories are empty. For e.g. just after repacking, the 'refs/heads' directory would be empty. The ref-cache seek mechanism, doesn't take this into consideration when descending into a subdirectory, and makes an out of bounds access, causing SEGFAULT as we try to access entries within the directory. Fix this by breaking out of the loop when we enter an empty directory.
Since we start with the base directory of 'refs/' which is never empty, it is okay to perform this check after the first iteration in the `do..while` clause.
Add tests which simulate this behavior and also provide coverage over using the feature over packed-refs.
Helped-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Karthik Nayak <karthik.188@gmail.com> --- Changes in v3: - Modify the commit message to also explain why it is safe to add the check for empty directories in a `do..while` clause. - Link to v2: https://lore.kernel.org/r/20250925-583-git-for-each-ref-start-after-v2-1-3613b5a27ff1@gmail.com
Changes in v2: - Moved the `dir-nr` check to the loop to provide better bound checks. - Modified the commit subject to talk about the issue at hand. - Substituted EOF with \EOF since we don't do any variable parsing. - Link to v1: https://lore.kernel.org/r/20250924-583-git-for-each-ref-start-after-v1-1-c73be2b5db5a@gmail.com --- refs/ref-cache.c | 2 +- t/t6302-for-each-ref-filter.sh | 65 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+), 1 deletion(-)
diff --git a/refs/ref-cache.c b/refs/ref-cache.c index c180e0aad7..e5e5df16d8 100644 --- a/refs/ref-cache.c +++ b/refs/ref-cache.c @@ -539,7 +539,7 @@ static int cache_ref_iterator_seek(struct ref_iterator *ref_iterator, */ break; } - } while (slash); + } while (slash && dir->nr); } return 0; diff --git a/t/t6302-for-each-ref-filter.sh b/t/t6302-for-each-ref-filter.sh index 9b80ea1e3b..7f060d97bf 100755 --- a/t/t6302-for-each-ref-filter.sh +++ b/t/t6302-for-each-ref-filter.sh @@ -754,4 +754,69 @@ test_expect_success 'start after used with custom sort order' ' test_cmp expect actual ' +test_expect_success 'start after with packed refs' ' + test_when_finished "rm -rf repo" && + git init repo && + ( + cd repo && + test_commit default && + + git update-ref --stdin <<-\EOF && + create refs/heads/branch @ + create refs/heads/side @ + create refs/odd/spot @ + create refs/tags/one @ + create refs/tags/two @ + commit + EOF + + cat >expect <<-\EOF && + refs/tags/default + refs/tags/one + refs/tags/two + EOF + + git pack-refs --all && + git for-each-ref --format="%(refname)" --start-after=refs/odd/spot >actual && + test_cmp expect actual + ) +' + +test_expect_success 'start after with packed refs and some loose refs' ' + test_when_finished "rm -rf repo" && + git init repo && + ( + cd repo && + test_commit default && + + git update-ref --stdin <<-\EOF && + create refs/heads/branch @ + create refs/heads/side @ + create refs/odd/spot @ + create refs/tags/one @ + create refs/tags/two @ + commit + EOF + + git pack-refs --all && + + git update-ref --stdin <<-\EOF && + create refs/heads/foo @ + create refs/odd/tee @ + commit + EOF + + cat >expect <<-\EOF && + refs/odd/tee + refs/tags/default + refs/tags/one + refs/tags/two + EOF + + + git for-each-ref --format="%(refname)" --start-after=refs/odd/spot >actual && + test_cmp expect actual + ) +' + test_done