git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re* [BUG] segmentation fault in git-diff

From
Junio C Hamano <gitster@pobox.com>
Date
Apr 10, 2020, 00:03 UTC
Message-ID
<xmqqv9m8kxzy.fsf_-_@gitster.c.googlers.com>
In-Reply-To
<20200409234152.GA42330@coredump.intra.peff.net>
Jeff King <peff@peff.net> writes:
> But there are a bunch of other commits around the same time replacing
> the_repository, and it seems like an easy mistake to make. Perhaps we
> should rename the "refs" member of "struct repository" to something more
> clearly private, which would force callers to use the access method.

Here is the final version that I am going to apply and merge to 'jch' branch. This is an ancient regression in Git timescale, so its fix is not all that urgent, though.

-- >8 --
Subject: [PATCH] sha1-name: do not assume that the ref store is initialized

c931ba4e (sha1-name.c: remove the_repo from handle_one_ref(), 2019-04-16) replaced the use of for_each_ref() helper, which works with the main ref store of the default repository instance, with refs_for_each_ref(), which can work on any ref store instance, by assuming that the repository instance the function is given has its ref store already initialized.

But it is possible that nobody has initialized it, in which case, the code ends up dereferencing a NULL pointer.

Reported-by: Érico Rolim <erico.erc@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 sha1-name.c                   | 2 +-
 t/t4208-log-magic-pathspec.sh | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/sha1-name.c b/sha1-name.c
index d9050776dd..3aba62938f 100644
--- a/sha1-name.c
+++ b/sha1-name.c
@@ -1771,7 +1771,7 @@ static enum get_oid_result get_oid_with_context_1(struct repository *repo,
 
 			cb.repo = repo;
 			cb.list = &list;
-			refs_for_each_ref(repo->refs, handle_one_ref, &cb);
+			refs_for_each_ref(get_main_ref_store(repo), handle_one_ref, &cb);
 			refs_head_ref(repo->refs, handle_one_ref, &cb);
 			commit_list_sort_by_date(&list);
 			return get_oid_oneline(repo, name + 2, oid, list);
diff --git a/t/t4208-log-magic-pathspec.sh b/t/t4208-log-magic-pathspec.sh
index 4c8f3b8e1b..6cdbe4747a 100755
--- a/t/t4208-log-magic-pathspec.sh
+++ b/t/t4208-log-magic-pathspec.sh
@@ -55,6 +55,10 @@ test_expect_success '"git log -- :/a" should not be ambiguous' '
 	git log -- :/a
 '
 
+test_expect_success '"git log :/any/path/" should not segfault' '
+	test_must_fail git log :/any/path/
+'
+
 # This differs from the ":/a" check above in that :/in looks like a pathspec,
 # but doesn't match an actual file.
 test_expect_success '"git log :/in" should not be ambiguous' '
-- 
2.26.0-106-g9fadedd637
Previous: Jeff KingNext: Érico Rolim
Message 7 of 10 in “[BUG] segmentation fault in git-diff”
  1. Érico RolimApr 9, 2020
  2. Junio C HamanoApr 9, 2020
  3. Junio C HamanoApr 9, 2020
  4. Junio C HamanoApr 9, 2020
  5. Junio C HamanoApr 9, 2020
  6. Jeff KingApr 9, 2020
  7. Re* [BUG] segmentation fault in git-diffJunio C Hamano, Apr 10, 2020
  8. Érico RolimApr 10, 2020
  9. Jeff KingApr 10, 2020
  10. Junio C HamanoApr 10, 2020

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.