# [PATCH] diff: fix lstat() error handling in diff_populate_filespec() 3 messages from 2017-10-27 to 2017-10-27. Participants: Andrey Okoshkin, Junio C Hamano. Thread: https://gitlist.dev/t/47041 ## Andrey Okoshkin, 2017-10-27 09:33 Subject: [PATCH] diff: fix lstat() error handling in diff_populate_filespec() Message-ID: <72e8146b-d4ab-ad7e-6afd-9168806eeca2@samsung.com> URL: https://gitlist.dev/e/72e8146b-d4ab-ad7e-6afd-9168806eeca2%40samsung.com In-Reply-To: ``` Add lstat() error handling not only for ENOENT case. Otherwise uninitialised 'struct stat st' variable is used later in case of lstat() non-ENOENT failure which leads to processing of rubbish values of file mode ('S_ISLNK(st.st_mode)' check) or size ('xsize_t(st.st_size)'). Signed-off-by: Andrey Okoshkin --- Hello, I've injected a fault to git binary with the internal tool for fault tolerance evaluation: lstat() returns '-1' and errno is set to 'EACCES' at diff_populate_filespec git/diff.c:2850. In a real life it's very difficult to reproduce such behaviour. I'm not sure why only ENOENT error of lstat() is considered as an error but passing by other errno values leads to reading of uninitialized 'struct stat st' variable. It means that the populated 'diff_filespec' structure may be incorrectly filled. Also diff_populate_filespec() result is not checked at diff_filespec_is_binary() but it seems OK there. Best regards, Andrey diff.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/diff.c b/diff.c index 8406a8324..d737a78a1 100644 --- a/diff.c +++ b/diff.c @@ -2848,14 +2848,12 @@ int diff_populate_filespec(struct diff_filespec *s, unsigned int flags) int fd; if (lstat(s->path, &st) < 0) { - if (errno == ENOENT) { - err_empty: - err = -1; - empty: - s->data = (char *)""; - s->size = 0; - return err; - } + err_empty: + err = -1; + empty: + s->data = (char *)""; + s->size = 0; + return err; } s->size = xsize_t(st.st_size); if (!s->size) -- 2.14.3 ``` ## Junio C Hamano, 2017-10-27 16:35 Subject: Re: [PATCH] diff: fix lstat() error handling in diff_populate_filespec() Message-ID: URL: https://gitlist.dev/e/xmqq3764czv9.fsf%40gitster.mtv.corp.google.com In-Reply-To: <72e8146b-d4ab-ad7e-6afd-9168806eeca2@samsung.com> ``` Andrey Okoshkin writes: > I'm not sure why only ENOENT error of lstat() is considered as an > error but passing by other errno values leads to reading of > uninitialized 'struct stat st' variable. It means that the > populated 'diff_filespec' structure may be incorrectly filled. Entirely correct. There is no fundamental reason to try special casing ENOENT, unless we are clearing the "this is an error" bit when the errno is ENOENT---but this code does not even do so. All errors are errors---we wanted to know the result of lstat() to carry on, and we couldn't figure out the status. We do not want to die immediately (instead we want to show diffs for other paths), so substituting the result with an empty string is the least bad thing we can do at this point in the code. ``` ## Junio C Hamano, 2017-10-27 16:58 Subject: Re: [PATCH] diff: fix lstat() error handling in diff_populate_filespec() Message-ID: URL: https://gitlist.dev/e/xmqqy3nwbk9x.fsf%40gitster.mtv.corp.google.com In-Reply-To: ``` Junio C Hamano writes: > Andrey Okoshkin writes: > >> I'm not sure why only ENOENT error of lstat() is considered as an >> error but passing by other errno values leads to reading of >> uninitialized 'struct stat st' variable. It means that the >> populated 'diff_filespec' structure may be incorrectly filled. > > Entirely correct. There is no fundamental reason to try special > casing ENOENT, unless we are clearing the "this is an error" bit > when the errno is ENOENT---but this code does not even do so. All > errors are errors---we wanted to know the result of lstat() to carry > on, and we couldn't figure out the status. We do not want to die > immediately (instead we want to show diffs for other paths), so > substituting the result with an empty string is the least bad thing > we can do at this point in the code. By the way, if the reason why we are hitting this lstat(2) (not the reason why lstat(2) is failing) is not because !s->oid.valid (i.e. we are reading the working tree side because that is what is on one side of the comparison) but because reuse_worktree_file() told us to (i.e. we actually are trying to fill the filespec with the blob contents, but found that we have already the same content in a working tree file and found it more efficient to read from there, rather than doing the read_sha1_file() on the s->oid.hash), it probably is better to fall back to the other side of the if/else when we see an error from this lstat(2) and pretend as if we got false from reuse_worktree_file(). That would allow us continue with the correct information we originally wanted to use; after all, reusing is merely an optimization. ```