Re: [BUG] rebase: can write reflog with uninit. `action` string

From: phillip.wood123@gmail.com <phillip.wood123@gmail.com>
Date: May 1, 2025, 14:10 UTC
Message-ID: <a834c708-8904-44c5-9481-5f796cf0054e@gmail.com>
In-Reply-To: <20250429215155.GA36727@coredump.intra.peff.net>

Hi Peff

On 29/04/2025 22:51, Jeff King wrote:

Show 22 quoted lines

> On Tue, Apr 29, 2025 at 09:40:13PM +0200, Kristoffer Haugsbakk wrote:
> 
>> On Tue, Apr 29, 2025, at 11:22, Phillip Wood wrote:
>>>> #0  run_git_commit (defmsg=0x555555babe70 "<repo path>/MERGE_MSG", opts=0x7fffffffc070, flags=0) at sequencer.c:1158
>>>
>>> Thanks for the backtrace. It would be useful to know what's stored in
>>> opts->ctx->reflog_message at this point if it's not too much trouble
>>> please can you run "print *opts" and "print *opts->ctx" here.
>>
>> Today I ran on f65182a99e5 (The ninth batch, 2025-04-24) at
>> sequencer.c:1148.  I was never able to reproduce this
>> `opts->ctx->reflog_message` having a weird value with GDB today.  The
>> reflog was also fine.
>>
>> Then I ran without GDB and I got the weird reflog that I expected.
> 
> Have you tried building with "make SANITIZE=address,undefined"?
> 
> This is a wild guess, but since ctx->reflog_message is pointing to a
> static strbuf, it could be a use after free if the strbuf is reallocated
> due to another call to reflog_message(), but we are still holding the
> old pointer via ctx->reflog_message.

Oh, nice insight. I'd forgotten we had callers of reflog_message() that didn't store the result in ctx->reflog_message. One of those callers is in do_reset() which due to the way the todo list gets constructed is likely to be called just before do_merge().

Thanks

Phillip