From: phillip.wood123@gmail.com Date: Thu, 01 May 2025 14:10:44 GMT Subject: Re: [BUG] rebase: can write reflog with uninit. `action` string Message-ID: In-Reply-To: <20250429215155.GA36727@coredump.intra.peff.net> Hi Peff On 29/04/2025 22:51, Jeff King wrote: > On Tue, Apr 29, 2025 at 09:40:13PM +0200, Kristoffer Haugsbakk wrote: > >> On Tue, Apr 29, 2025, at 11:22, Phillip Wood wrote: >>>> #0 run_git_commit (defmsg=0x555555babe70 "/MERGE_MSG", opts=0x7fffffffc070, flags=0) at sequencer.c:1158 >>> >>> Thanks for the backtrace. It would be useful to know what's stored in >>> opts->ctx->reflog_message at this point if it's not too much trouble >>> please can you run "print *opts" and "print *opts->ctx" here. >> >> Today I ran on f65182a99e5 (The ninth batch, 2025-04-24) at >> sequencer.c:1148. I was never able to reproduce this >> `opts->ctx->reflog_message` having a weird value with GDB today. The >> reflog was also fine. >> >> Then I ran without GDB and I got the weird reflog that I expected. > > Have you tried building with "make SANITIZE=address,undefined"? > > This is a wild guess, but since ctx->reflog_message is pointing to a > static strbuf, it could be a use after free if the strbuf is reallocated > due to another call to reflog_message(), but we are still holding the > old pointer via ctx->reflog_message. Oh, nice insight. I'd forgotten we had callers of reflog_message() that didn't store the result in ctx->reflog_message. One of those callers is in do_reset() which due to the way the todo list gets constructed is likely to be called just before do_merge(). Thanks Phillip