[PATCH 0/1] diffcore-break: prevent dangling pointer

The diffcore_break function in diffcore-break.c forgets to set the queue reference to NULL after freeing it. In a blobless cloned repository, the queue could be accessed by prefetch and result in a segmentation fault.

This bug is only triggered if:
* the repository is partially cloned
* the diff operation triggers prefetch
* a diff is split into delete and create before prefetching

I've prepared a example repository that triggers this bug.

  git clone git@github.com:hanyang-tony/dangle_sanitize.git --filter=blob:none
  cd dangle_sanitize

  # download the old version of the file
  # to ensure the splited diff exists in local repository
  git checkout HEAD~1 .iac

  # reset the file so we have a diff 
  git reset --hard HEAD

  # segmentation fault
  git reset HEAD~1

Here is how to create the example repository:

  mkdir example && cd example && git init
  mkdir -p .iac/configs/devops
  cat >.iac/configs/devops/config.yml <<EOL
whiteListInfo:
  - target: TARGET1
    emails:
      - user01
      - user02
      - user03
      - user04
      - user05
      - user06
      - user07
      - user08
      - user09
      - user10
      - user11
      - user12
      - user13
  - target: TARGET2
    department:
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_01
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_02
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_03
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_04
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_05
  - target: TARGET3
    emails:
      - user14
  - target: TARGET4
    department:
      - DEPARTMENT_06
    emails:
      - user15
  - target: TARGET5
    department:
      - DEPARTMENT_07
  - target: TARGET6
    department:
      - DEPARTMENT_08
EOL

  echo bar >> foo.c
  git add -A && git commit -m init

  echo baz >> foo.c
cat >.iac/configs/devops/config.yml <<EOL
whiteListInfo:
  - target: TARGET1
    emails:
      - user01
      - user02
      - user03
      - user04
      - user05
      - user06
      - user07
      - user08
      - user09
      - user10
      - user11
      - user12
      - user13
  - target: TARGET2
    department:
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENTS_01
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENTS_02
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENTS_03
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENTS_04
      - DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENT_DEPARTMENTS_05
  - target: TARGET3
    emails:
      - user14
  - target: TARGET4
    department:
      - DEPARTMENT_06
    emails:
      - user15
  - target: TARGET5
    department:
      - DEPARTMENT_07
  - target: TARGET6
    department:
      - DEPARTMENT_08
EOL

  git add -A && git commit -m 1

After partially cloning the the example repository, fetch the old version of .iac/configs/devops/config.yml. Trying to reset to the initial commit should result in a segmentation fault.

Han Young (1):
  diffcore-break: prevent dangling pointer

 diffcore-break.c | 1 +
 1 file changed, 1 insertion(+)