git-http-fetch Segmentation fault

 Hi,

 A friend of mine reported an easy to reproduce segmentation fault
when cloning through http from his repository:

""" ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git got 299cdadd846913a052df361e973a947622f23198 walk 299cdadd846913a052df361e973a947622f23198 ... got 0ecd10d9d6ab020c2469a961777854afda705776 /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1" """

 Sometimes it shows up as a corrupted double-linked list, detected by
glibc:

""" *** glibc detected *** git-http-fetch: corrupted double-linked list: 0x080a5680 *** """

 It's reproducible with Junio's master and maint branches (3082ac and
53a582 respectivelly).

 BTW, At line 406 (the trap command), git-clone script removes the
directory it was fetching. This removes the core dump file too.
We should not remove the directory if there's a core dump in there.

"Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:

Does not seem to reproduce for me on my x86_64 box nor an i386 box I happened to have access to. Both run Debian etch.

Here is an excerpt from a valgrind run on the x86_64 box. It does seem to find a handful "problematic" accesses, but all seem to be in the system libraries. I did not get any errors on the i386 box.

: gitster v/master; valgrind git-http-fetch -v -a -w remotes/origin/master 299cdadd846913a052df361e973a947622f23198 http://people.mandriva.com/~boiko/mandrivamenu.git/

==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010AEE: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010AF9: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010B04: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010C61: (within /lib/ld-2.3.6.so) ==2120== by 0x4006E47: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Invalid read of size 8 ==2120== at 0x4010C54: (within /lib/ld-2.3.6.so) ==2120== by 0x4008D38: (within /lib/ld-2.3.6.so) ==2120== by 0x4004CF2: (within /lib/ld-2.3.6.so) ==2120== by 0x4006D6C: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== Address 0x5F096F0 is 16 bytes inside a block of size 23 alloc'd ==2120== at 0x4A1B858: malloc (vg_replace_malloc.c:149) ==2120== by 0x4007113: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ... ==2120== ==2120== IN SUMMARY: 6 errors from 5 contexts (suppressed: 9 from 1) ==2120==

Em Tue, 08 May 2007 13:04:47 -0700 Junio C Hamano <junkio@cox.net> escreveu:

| "Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:
| 
| >  A friend of mine reported an easy to reproduce segmentation fault
| > when cloning through http from his repository:
| >
| > """
| > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
| > got 299cdadd846913a052df361e973a947622f23198
| > walk 299cdadd846913a052df361e973a947622f23198
| > ...
| > got 0ecd10d9d6ab020c2469a961777854afda705776
| > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault      (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
| > """
| >
| >  Sometimes it shows up as a corrupted double-linked list, detected by
| > glibc:
| 
| Does not seem to reproduce for me on my x86_64 box nor an i386
| box I happened to have access to.  Both run Debian etch.

 Forgot to say that you have to try a few times to reproduce.

 Boiko, can you try it on another distro? NSL maybe? I only run
Mandriva on my machines.

Em Tue, 8 May 2007 17:13:10 -0300 "Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:

| Em Tue, 08 May 2007 13:04:47 -0700
| Junio C Hamano <junkio@cox.net> escreveu:
| 
| | "Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:
| | 
| | >  A friend of mine reported an easy to reproduce segmentation fault
| | > when cloning through http from his repository:
| | >
| | > """
| | > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
| | > got 299cdadd846913a052df361e973a947622f23198
| | > walk 299cdadd846913a052df361e973a947622f23198
| | > ...
| | > got 0ecd10d9d6ab020c2469a961777854afda705776
| | > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault      (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
| | > """
| | >
| | >  Sometimes it shows up as a corrupted double-linked list, detected by
| | > glibc:
| | 
| | Does not seem to reproduce for me on my x86_64 box nor an i386
| | box I happened to have access to.  Both run Debian etch.
| 
|  Forgot to say that you have to try a few times to reproduce.

 And, looks like you need http_proxy set too.

 Sorry for the bad report. :-|