threads / discuss / 4248

git-diff-tree crashes on ubuntu kernel git repository

Subject: git-diff-tree crashes on ubuntu kernel git repository

## tl;dr

5 messages between May 22, 2006 and May 23, 2006.

replies: 4people: 4as markdown or json

Torgil Svensson· May 22, 2006, 23:09 UTC · lore

Hi

It seems like git-diff-tree has some problems with moved files:

$ git-diff-tree -p --stat --summary -M 348f179e3195448cea49c98a79cce8c7f446ce26 343ca16424ba031b37e4df49afddaee098a8f347 | wc -l *** glibc detected *** free(): invalid pointer: 0x12ecbbf0 *** 6101

As can be seen below there is some obvious error in the output just
prior to the crash:
 drivers/w1/{masters => }/ds_w1_bridge.c            |   38

This file is moved into "w1/masters" by commit bd529cfb40c427d5b5aae0d315afb9f0a1da5e76

$ git --version git version 1.3.3.g5e36

$ cat .git/remotes/origin
URL: git://git.kernel.org/pub/scm/linux/kernel/git/bcollins/ubuntu-2.6
Pull: refs/heads/master:refs/heads/origin

 $ gdb git-diff-tree
(gdb) run -p --stat --summary -M
348f179e3195448cea49c98a79cce8c7f446ce26
343ca16424ba031b37e4df49afddaee098a8f347

<...lots of files...>

 drivers/video/w100fb.c                             |  162
 drivers/video/w100fb.h                             |  748 -
 drivers/w1/Kconfig                                 |   62
 drivers/w1/Makefile                                |   10
 drivers/w1/{masters => }/ds_w1_bridge.c            |   38
*** glibc detected *** free(): invalid pointer: 0x12ecbbf0 ***

Program received signal SIGABRT, Aborted. 0xffffe410 in __kernel_vsyscall () (gdb) bt #0 0xffffe410 in __kernel_vsyscall () #1 0xb7d7e9a1 in raise () from /lib/tls/i686/cmov/libc.so.6 #2 0xb7d802b9 in abort () from /lib/tls/i686/cmov/libc.so.6 #3 0xb7db287a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6 #4 0xb7db8fd4 in malloc_usable_size () from /lib/tls/i686/cmov/libc.so.6 #5 0xb7db934a in free () from /lib/tls/i686/cmov/libc.so.6 #6 0x08056902 in show_stats (data=0x8deff80) at diff.c:392 #7 0x08058466 in diff_flush (options=0x80686b0) at diff.c:1999 #8 0x0805b143 in log_tree_diff_flush (opt=0x8068680) at log-tree.c:82 #9 0x08049d11 in main (argc=0, argv=0xbfcf8a14) at diff-tree.c:130 (gdb)

As shown above I can easily recreate the crash if you want more info. Thank you for a wonderful tool.

//Torgil

Sean· May 23, 2006, 00:36 UTC · re: Torgil Svensson · lore

[PATCH] Avoid segfault in diff --stat rename output.

Signed-off-by: Sean Estabrooks <seanlkml@sympatico.ca>
---
 diff.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

On Tue, 23 May 2006 01:09:43 +0200 "Torgil Svensson" <torgil.svensson@gmail.com> wrote:

Show 9 quoted lines

> Hi
> 
> It seems like git-diff-tree has some problems with moved files:
> 
> $ git-diff-tree -p --stat --summary -M
> 348f179e3195448cea49c98a79cce8c7f446ce26
> 343ca16424ba031b37e4df49afddaee098a8f347 | wc -l
> *** glibc detected *** free(): invalid pointer: 0x12ecbbf0 ***
> 6101

diff --git a/diff.c b/diff.c
index 7f35e59..a7bb9b9 100644
--- a/diff.c
+++ b/diff.c
@@ -237,7 +237,7 @@ static char *pprint_rename(const char *a
 		if (a_midlen < 0) a_midlen = 0;
 		if (b_midlen < 0) b_midlen = 0;
 
-		name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
+		name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
 		sprintf(name, "%.*s{%.*s => %.*s}%s",
 			pfx_length, a,
 			a_midlen, a + pfx_length,

-- 
1.3.GIT

Junio C Hamano· May 23, 2006, 01:02 UTC · re: Sean · lore

Re: [PATCH] Avoid segfault in diff --stat rename output.

Sean <seanlkml@sympatico.ca> writes:

Show 16 quoted lines

> Signed-off-by: Sean Estabrooks <seanlkml@sympatico.ca>
> ---
>  diff.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/diff.c b/diff.c
> index 7f35e59..a7bb9b9 100644
> --- a/diff.c
> +++ b/diff.c
> @@ -237,7 +237,7 @@ static char *pprint_rename(const char *a
>  		if (a_midlen < 0) a_midlen = 0;
>  		if (b_midlen < 0) b_midlen = 0;
>  
> -		name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
> +		name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
>  		sprintf(name, "%.*s{%.*s => %.*s}%s",

Obviously correct given what the sprintf() that immediately follows does. Sheesh, what was I smoking back then. *BLUSH*

Thanks.

Dmitry V. Levin· May 23, 2006, 11:28 UTC · re: Junio C Hamano · lore

Q: xasprintf

Hi,

On Mon, May 22, 2006 at 06:02:39PM -0700, Junio C Hamano wrote:

> Sean <seanlkml@sympatico.ca> writes:

[...]

Show 6 quoted lines

> > -		name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
> > +		name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
> >  		sprintf(name, "%.*s{%.*s => %.*s}%s",
> 
> Obviously correct given what the sprintf() that immediately
> follows does.  Sheesh, what was I smoking back then.  *BLUSH*

What about introducing xasprintf() to eliminate such issues?

-- 
ldv

Torgil Svensson· May 23, 2006, 19:06 UTC · re: Sean · lore

Re: [PATCH] Avoid segfault in diff --stat rename output.

This patch fixed the issue for me.

On 5/23/06, Sean <seanlkml@sympatico.ca> wrote:

Show 37 quoted lines

>
> Signed-off-by: Sean Estabrooks <seanlkml@sympatico.ca>
> ---
>  diff.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> On Tue, 23 May 2006 01:09:43 +0200
> "Torgil Svensson" <torgil.svensson@gmail.com> wrote:
>
> > Hi
> >
> > It seems like git-diff-tree has some problems with moved files:
> >
> > $ git-diff-tree -p --stat --summary -M
> > 348f179e3195448cea49c98a79cce8c7f446ce26
> > 343ca16424ba031b37e4df49afddaee098a8f347 | wc -l
> > *** glibc detected *** free(): invalid pointer: 0x12ecbbf0 ***
> > 6101
>
>
> diff --git a/diff.c b/diff.c
> index 7f35e59..a7bb9b9 100644
> --- a/diff.c
> +++ b/diff.c
> @@ -237,7 +237,7 @@ static char *pprint_rename(const char *a
>                 if (a_midlen < 0) a_midlen = 0;
>                 if (b_midlen < 0) b_midlen = 0;
>
> -               name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
> +               name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
>                 sprintf(name, "%.*s{%.*s => %.*s}%s",
>                         pfx_length, a,
>                         a_midlen, a + pfx_length,
> --
> 1.3.GIT
>
>