threads / patch / 56125

patchmulti-pack-index: fix potential segfault without sub-command

Subject: [PATCH] multi-pack-index: fix potential segfault without sub-command

## tl;dr

4 messages between Jul 19, 2021 and Jul 23, 2021. Diffs are folded; open one to read it.

replies: 3people: 2as markdown or json

Taylor Blau· Jul 19, 2021, 17:18 UTC · lore

Since cd57bc41bb (builtin/multi-pack-index.c: display usage on unrecognized command, 2021-03-30) we have used a "usage" label to avoid having two separate callers of usage_with_options (one when no arguments are given, and another for unrecognized sub-commands).

But the first caller has been broken since cd57bc41bb, since it will happily jump to usage without arguments, and then pass argv[0] to the "unrecognized subcommand" error.

Many compilers will save us from a segfault here, but the end result is ugly, since it mentions an unrecognized subcommand when we didn't even pass one, and (on GCC) includes "(null)" in its output.

Move the "usage" label down past the error about unrecognized subcommands so that it is only triggered when it should be. While we're at it, bulk up our test coverage in this area, too.

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
Noticed this while I was reading code in a similar area while reviewing
one of Ævar's series.

 builtin/multi-pack-index.c  | 2 +-
 t/t5319-multi-pack-index.sh | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

Show changes to 2 files +6 −2

builtin/multi-pack-index.c, t/t5319-multi-pack-index.sh

diff --git a/builtin/multi-pack-index.c b/builtin/multi-pack-index.c
index 5d3ea445fd..8ff0dee2ec 100644
--- a/builtin/multi-pack-index.c
+++ b/builtin/multi-pack-index.c
@@ -176,8 +176,8 @@ int cmd_multi_pack_index(int argc, const char **argv,
 	else if (!strcmp(argv[0], "expire"))
 		return cmd_multi_pack_index_expire(argc, argv);
 	else {
-usage:
 		error(_("unrecognized subcommand: %s"), argv[0]);
+usage:
 		usage_with_options(builtin_multi_pack_index_usage,
 				   builtin_multi_pack_index_options);
 	}
diff --git a/t/t5319-multi-pack-index.sh b/t/t5319-multi-pack-index.sh
index 5641d158df..dab7123b3a 100755
--- a/t/t5319-multi-pack-index.sh
+++ b/t/t5319-multi-pack-index.sh
@@ -824,4 +824,9 @@ test_expect_success 'load reverse index when missing .idx, .pack' '
 	)
 '

+test_expect_success 'usage shown without sub-command' '
+	test_expect_code 129 git multi-pack-index 2>err &&
+	! test_i18ngrep "unrecognized subcommand" err
+'
+
 test_done
--
2.31.1.163.ga65ce7f831

Jeff King· Jul 21, 2021, 08:10 UTC · re: Taylor Blau · lore

Re: [PATCH] multi-pack-index: fix potential segfault without sub-command

On Mon, Jul 19, 2021 at 01:18:49PM -0400, Taylor Blau wrote:

Show 16 quoted lines

> Since cd57bc41bb (builtin/multi-pack-index.c: display usage on
> unrecognized command, 2021-03-30) we have used a "usage" label to avoid
> having two separate callers of usage_with_options (one when no arguments
> are given, and another for unrecognized sub-commands).
> 
> But the first caller has been broken since cd57bc41bb, since it will
> happily jump to usage without arguments, and then pass argv[0] to the
> "unrecognized subcommand" error.
> 
> Many compilers will save us from a segfault here, but the end result is
> ugly, since it mentions an unrecognized subcommand when we didn't even
> pass one, and (on GCC) includes "(null)" in its output.
> 
> Move the "usage" label down past the error about unrecognized
> subcommands so that it is only triggered when it should be. While we're
> at it, bulk up our test coverage in this area, too.

Good find. The code change seems obviously correct.

> +test_expect_success 'usage shown without sub-command' '
> +	test_expect_code 129 git multi-pack-index 2>err &&
> +	! test_i18ngrep "unrecognized subcommand" err
> +'

I think we're avoiding test_i18ngrep in new code these days.

-Peff

Taylor Blau· Jul 21, 2021, 16:52 UTC · re: Jeff King · lore

[PATCH v2] multi-pack-index: fix potential segfault without sub-command

But the first caller has been broken since cd57bc41bb, since it will happily jump to usage without arguments, and then pass argv[0] to the "unrecognized subcommand" error.

Many compilers will save us from a segfault here, but the end result is ugly, since it mentions an unrecognized subcommand when we didn't even pass one, and (on GCC) includes "(null)" in its output.

Move the "usage" label down past the error about unrecognized subcommands so that it is only triggered when it should be. While we're at it, bulk up our test coverage in this area, too.

Signed-off-by: Taylor Blau <me@ttaylorr.com>
---
I didn't realize that we are veering away from test_i18ngrep in new
tests, so here's a version of this trivial patch with grep instead.

Range-diff against v1:
1:  8c0bb3e0dc ! 1:  1280413042 multi-pack-index: fix potential segfault without sub-command
    @@ t/t5319-multi-pack-index.sh: test_expect_success 'load reverse index when missin

     +test_expect_success 'usage shown without sub-command' '
     +	test_expect_code 129 git multi-pack-index 2>err &&
    -+	! test_i18ngrep "unrecognized subcommand" err
    ++	! grep "unrecognized subcommand" err
     +'
     +
      test_done

 builtin/multi-pack-index.c  | 2 +-
 t/t5319-multi-pack-index.sh | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

Show changes to 2 files +6 −2

builtin/multi-pack-index.c, t/t5319-multi-pack-index.sh

diff --git a/builtin/multi-pack-index.c b/builtin/multi-pack-index.c
index 5d3ea445fd..8ff0dee2ec 100644
--- a/builtin/multi-pack-index.c
+++ b/builtin/multi-pack-index.c
@@ -176,8 +176,8 @@ int cmd_multi_pack_index(int argc, const char **argv,
 	else if (!strcmp(argv[0], "expire"))
 		return cmd_multi_pack_index_expire(argc, argv);
 	else {
-usage:
 		error(_("unrecognized subcommand: %s"), argv[0]);
+usage:
 		usage_with_options(builtin_multi_pack_index_usage,
 				   builtin_multi_pack_index_options);
 	}
diff --git a/t/t5319-multi-pack-index.sh b/t/t5319-multi-pack-index.sh
index 7609f1ea64..c0ec5a6fd3 100755
--- a/t/t5319-multi-pack-index.sh
+++ b/t/t5319-multi-pack-index.sh
@@ -837,4 +837,9 @@ test_expect_success 'load reverse index when missing .idx, .pack' '
 	)
 '

+test_expect_success 'usage shown without sub-command' '
+	test_expect_code 129 git multi-pack-index 2>err &&
+	! grep "unrecognized subcommand" err
+'
+
 test_done
--
2.31.1.163.ga65ce7f831

Jeff King· Jul 23, 2021, 07:34 UTC · re: Taylor Blau · lore

Re: [PATCH v2] multi-pack-index: fix potential segfault without sub-command

On Wed, Jul 21, 2021 at 12:52:37PM -0400, Taylor Blau wrote:

> I didn't realize that we are veering away from test_i18ngrep in new
> tests, so here's a version of this trivial patch with grep instead.

This looks fine to me, but it looks like Junio may have already merged the original into 'next' via 995cb54b5b (Merge branch 'tb/reverse-midx' into next, 2021-07-20).

So we'd have to update it on top. I think we can just leave it be, though. There's nothing incorrect about using test_i18ngrep for now, and there are a ton of existing instances to handle if we choose to do a bulk cleanup. One more isn't a big deal.

-Peff