git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v5] [GSOC] ref-filter: fix read invalid union member bug

From
ZheNing Hu via GitGitGadget <gitgitgadget@gmail.com>
Date
May 11, 2021, 15:35 UTC
Message-ID
<pull.949.v5.git.1620747320947.gitgitgadget@gmail.com>
In-Reply-To
<pull.949.v4.git.1620658904283.gitgitgadget@gmail.com>
From: ZheNing Hu <adlternative@gmail.com>

used_atom.u is an union, and it has different members depending on what atom the auxiliary data the union part of the "struct used_atom" wants to record. At most only one of the members can be valid at any one time. Since the code checks u.remote_ref without even making sure if the atom is "push" or "push:" (which are only two cases that u.remote_ref.push becomes valid), but u.remote_ref shares the same storage for other members of the union, the check was reading from an invalid member, which was the bug.

Modify the condition here to check whether the atom name equals to "push" or starts with "push:", to avoid reading the value of invalid member of the union.

Helped-by: Junio C Hamano <gitster@pobox.com>
Signed-off-by: ZheNing Hu <adlternative@gmail.com>
---
    [GSOC] ref-filter: fix read invalid union member bug
    
    I and Junio discussed the situation that this bug might actually occur.
    
    The damage that can be found currently is using %(colors:#aa22ac) or
    some other %(colors) atoms. But Junio found that testing
    %(colors:#aa22ac) alone did not show the expected bug in the commit
    before the repair.
    
    So I conducted an experiment:
    
    When we use git push, Git will add some config, these configurations
    will affect the result of the execution process related to atom %(push)
    in populate_value().
    
    Change from last version: added a new test, which added two
    configurations:
    
    git config branch.main.remote origin git config branch.main.merge
    refs/heads/main
    
    used to simulate the configuration changes brought by git push.
    
    Finally, a test on the broken atom %(colors:#aa22ac). In the commit
    before the repair, breakage occurs. In the commit after the repair,
    breakage disappeared.
Published-As: https://github.com/gitgitgadget/git/releases/tag/pr-949%2Fadlternative%2Fref-filter-enum-bug-fix-v5
Fetch-It-Via: git fetch https://github.com/gitgitgadget/git pr-949/adlternative/ref-filter-enum-bug-fix-v5
Pull-Request: https://github.com/gitgitgadget/git/pull/949
Range-diff vs v4:
 1:  8c6c0368a590 ! 1:  b546477e8c87 [GSOC] ref-filter: fix read invalid union member bug
     @@ t/t6302-for-each-ref-filter.sh: test_expect_success '%(color) must fail' '
       	test_must_fail git for-each-ref --format="%(color)%(refname)"
       '
       
     -+test_expect_success '%(color:#aa22ac) must success' '
     ++test_expect_success '%(color:#aa22ac) must successed' '
     ++	test_when_finished "cd .. && rm -rf ./test" &&
     ++	mkdir test &&
     ++	cd test &&
     ++	git init &&
      +	cat >expect <<-\EOF &&
      +	refs/heads/main
     -+	refs/heads/side
     -+	refs/odd/spot
     -+	refs/tags/annotated-tag
     -+	refs/tags/doubly-annotated-tag
     -+	refs/tags/doubly-signed-tag
     -+	refs/tags/four
     -+	refs/tags/one
     -+	refs/tags/signed-tag
     -+	refs/tags/three
     -+	refs/tags/two
      +	EOF
     ++	git add . &&
     ++	git branch -M main &&
     ++	git commit -m "test" &&
     ++	git remote add origin nowhere &&
     ++	git config branch.main.remote origin &&
     ++	git config branch.main.merge refs/heads/main &&
      +	git for-each-ref --format="%(color:#aa22ac)%(refname)" >actual &&
      +	test_cmp expect actual
      +'
 ref-filter.c                   |  2 +-
 t/t6302-for-each-ref-filter.sh | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)
diff --git a/ref-filter.c b/ref-filter.c
index a0adb4551d87..213d3773ada3 100644
--- a/ref-filter.c
+++ b/ref-filter.c
@@ -1730,7 +1730,7 @@ static int populate_value(struct ref_array_item *ref, struct strbuf *err)
 			else
 				v->s = xstrdup("");
 			continue;
-		} else if (atom->u.remote_ref.push) {
+		} else if (!strcmp(atom->name, "push") || starts_with(atom->name, "push:")) {
 			const char *branch_name;
 			v->s = xstrdup("");
 			if (!skip_prefix(ref->refname, "refs/heads/",
diff --git a/t/t6302-for-each-ref-filter.sh b/t/t6302-for-each-ref-filter.sh
index 9866b1b57368..309cf699506f 100755
--- a/t/t6302-for-each-ref-filter.sh
+++ b/t/t6302-for-each-ref-filter.sh
@@ -117,6 +117,24 @@ test_expect_success '%(color) must fail' '
 	test_must_fail git for-each-ref --format="%(color)%(refname)"
 '
 
+test_expect_success '%(color:#aa22ac) must successed' '
+	test_when_finished "cd .. && rm -rf ./test" &&
+	mkdir test &&
+	cd test &&
+	git init &&
+	cat >expect <<-\EOF &&
+	refs/heads/main
+	EOF
+	git add . &&
+	git branch -M main &&
+	git commit -m "test" &&
+	git remote add origin nowhere &&
+	git config branch.main.remote origin &&
+	git config branch.main.merge refs/heads/main &&
+	git for-each-ref --format="%(color:#aa22ac)%(refname)" >actual &&
+	test_cmp expect actual
+'
+
 test_expect_success 'left alignment is default' '
 	cat >expect <<-\EOF &&
 	refname is refs/heads/main    |refs/heads/main

base-commit: 311531c9de557d25ac087c1637818bd2aad6eb3a
-- 
gitgitgadget
Previous: ZheNing HuNext: Junio C Hamano
Message 25 of 31 in “[GSOC] ref-filter: solve bugs caused by enumeration”
  1. [GSOC] ref-filter: solve bugs caused by enumerationZheNing Hu via GitGitGadget, May 5, 2021
  2. Junio C HamanoMay 6, 2021
  3. ZheNing HuMay 6, 2021
  4. Junio C HamanoMay 6, 2021
  5. ZheNing HuMay 6, 2021
  6. Junio C HamanoMay 6, 2021
  7. ZheNing HuMay 6, 2021
  8. Junio C HamanoMay 6, 2021
  9. ZheNing HuMay 7, 2021
  10. Junio C HamanoMay 7, 2021
  11. ZheNing HuMay 7, 2021
  12. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 6, 2021
  13. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 8, 2021
  14. Junio C HamanoMay 10, 2021
  15. ZheNing HuMay 10, 2021
  16. Junio C HamanoMay 10, 2021
  17. ZheNing HuMay 10, 2021
  18. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 10, 2021
  19. Junio C HamanoMay 11, 2021
  20. ZheNing HuMay 11, 2021
  21. Junio C HamanoMay 11, 2021
  22. ZheNing HuMay 11, 2021
  23. Junio C HamanoMay 11, 2021
  24. ZheNing HuMay 11, 2021
  25. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 11, 2021
  26. Junio C HamanoMay 12, 2021
  27. ZheNing HuMay 12, 2021
  28. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 12, 2021
  29. Junio C HamanoMay 12, 2021
  30. ZheNing HuMay 13, 2021
  31. [GSOC] ref-filter: fix read invalid union member bugZheNing Hu via GitGitGadget, May 13, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.