Re: Git 1.6.5-rc git clone unhandled exception using http protocol

From: Michael Wookey <michaelwookey@gmail.com>
Date: Oct 13, 2009, 10:10 UTC
Message-ID: <d2e97e800910130310wa9731a6j9b9bdd25047ade85@mail.gmail.com>
In-Reply-To: <4AD0BBCB.8000306@gmail.com>

2009/10/11 eduard stefan <eduard.stefan@gmail.com>:

Show 14 quoted lines

> Tay Ray Chuan wrote:
>> I suspect, as you do, it's got to do with remote-curl.
>>
>> Could you try this command?
>>
>>   echo list | git remote-curl http://github.com/loudej/spark.git
>
> Inside an empty repository it crashes the same way,
> without any additional information.
> "git remote-curl" crashes in the same way,
> but "git remote-curl --help" tries to launch the browser.
>
> Is there any way to obtain more information from this crash?
> Some debug mode?

Using the above repository, I see the same crash with msysGit at git revision 1.6.5. Using windbg as the post-mortem debugger, the following information is captured:

  (a14.e8c): Access violation - code c0000005 (!!! second chance !!!)
  eax=00000000 ebx=00000000 ecx=ffffffff edx=0046cc00 esi=0046f98f edi=00000000
  eip=00420354 esp=0022fd80 ebp=0022fda8 iopl=0         nv up ei pl zr na pe nc
  cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246

...and the faulting instruction is:

  git_remote_curl+0x20354:
  00420354 f2ae            repne scas byte ptr es:[edi]

so, a NULL dereference. The initial disassembly of the function is this:

  0:000> u 0042033C
  git_remote_curl+0x2033c:
  0042033c 55              push    ebp
  0042033d 89e5            mov     ebp,esp
  0042033f 57              push    edi
  00420340 56              push    esi
  00420341 53              push    ebx
  00420342 83ec1c          sub     esp,1Ch
  00420345 8b5d08          mov     ebx,dword ptr [ebp+8]
  00420348 8b750c          mov     esi,dword ptr [ebp+0Ch]
  0042034b 31c0            xor     eax,eax
  0042034d b9ffffffff      mov     ecx,0FFFFFFFFh
  00420352 89df            mov     edi,ebx
  00420354 f2ae            repne scas byte ptr es:[edi]
  00420356 f7d1            not     ecx
  00420358 8d51ff          lea     edx,[ecx-1]
  0042035b b9ffffffff      mov     ecx,0FFFFFFFFh
  00420360 89f7            mov     edi,esi
  00420362 f2ae            repne scas byte ptr es:[edi]
  00420364 f7d1            not     ecx
  00420366 49              dec     ecx
  00420367 7466            je      git_remote_curl+0x203cf (004203cf)
  00420369 85d2            test    edx,edx
  0042036b 0f84b1000000    je      git_remote_curl+0x20422 (00420422)
  00420371 89f7            mov     edi,esi
  00420373 89de            mov     esi,ebx
  ...

So its the first parameter that is NULL. The second parameter is:

  0:000> da poi(ebp+c)
  0046f98f  "libexec/git-core"

I don't know how to build msysGit so that symbols are generated so I've attempted to reconstruct the source code; which ends up looking something like the following:

  int some_unknown_func(char *arg1, char *arg2)
  {
      len1 = strlen(arg1) - 1;  // <- crash here
      len2 = strlen(arg2);
      len3 = len2 - 1;

      if (len2 != 1) {
          if (!len1)
              return 0;
          for (;;) {
              x = arg1[len1 - 1];

              if (x != '/' && x != '\\') {
                  --len1;
                  --len3;
                  if (arg1[len1] != arg2[len3])
                      return 0;
              } else {
                  ...
              }
          }
      }
  }

Perhaps those more familiar with git's sources might recognise code that looks similar to the above sequence.