# git-http-fetch Segmentation fault 4 messages from 2007-05-08 to 2007-05-08. Participants: Luiz Fernando N. Capitulino, Junio C Hamano. Thread: https://gitlist.dev/t/8036 ## Luiz Fernando N. Capitulino, 2007-05-08 19:27 Subject: git-http-fetch Segmentation fault Message-ID: <20070508162735.6c530a70@localhost> URL: https://gitlist.dev/e/20070508162735.6c530a70%40localhost ``` Hi, A friend of mine reported an easy to reproduce segmentation fault when cloning through http from his repository: """ ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git got 299cdadd846913a052df361e973a947622f23198 walk 299cdadd846913a052df361e973a947622f23198 ... got 0ecd10d9d6ab020c2469a961777854afda705776 /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1" """ Sometimes it shows up as a corrupted double-linked list, detected by glibc: """ *** glibc detected *** git-http-fetch: corrupted double-linked list: 0x080a5680 *** """ It's reproducible with Junio's master and maint branches (3082ac and 53a582 respectivelly). BTW, At line 406 (the trap command), git-clone script removes the directory it was fetching. This removes the core dump file too. We should not remove the directory if there's a core dump in there. -- Luiz Fernando N. Capitulino ``` ## Junio C Hamano, 2007-05-08 20:04 Subject: Re: git-http-fetch Segmentation fault Message-ID: <7vfy672iao.fsf@assigned-by-dhcp.cox.net> URL: https://gitlist.dev/e/7vfy672iao.fsf%40assigned-by-dhcp.cox.net In-Reply-To: <20070508162735.6c530a70@localhost> ``` "Luiz Fernando N. Capitulino" escreveu: > A friend of mine reported an easy to reproduce segmentation fault > when cloning through http from his repository: > > """ > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git > got 299cdadd846913a052df361e973a947622f23198 > walk 299cdadd846913a052df361e973a947622f23198 > ... > got 0ecd10d9d6ab020c2469a961777854afda705776 > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1" > """ > > Sometimes it shows up as a corrupted double-linked list, detected by > glibc: Does not seem to reproduce for me on my x86_64 box nor an i386 box I happened to have access to. Both run Debian etch. Here is an excerpt from a valgrind run on the x86_64 box. It does seem to find a handful "problematic" accesses, but all seem to be in the system libraries. I did not get any errors on the i386 box. : gitster v/master; valgrind git-http-fetch -v -a -w remotes/origin/master 299cdadd846913a052df361e973a947622f23198 http://people.mandriva.com/~boiko/mandrivamenu.git/ ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010AEE: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010AF9: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010B04: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010C61: (within /lib/ld-2.3.6.so) ==2120== by 0x4006E47: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Invalid read of size 8 ==2120== at 0x4010C54: (within /lib/ld-2.3.6.so) ==2120== by 0x4008D38: (within /lib/ld-2.3.6.so) ==2120== by 0x4004CF2: (within /lib/ld-2.3.6.so) ==2120== by 0x4006D6C: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== Address 0x5F096F0 is 16 bytes inside a block of size 23 alloc'd ==2120== at 0x4A1B858: malloc (vg_replace_malloc.c:149) ==2120== by 0x4007113: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ... ==2120== ==2120== IN SUMMARY: 6 errors from 5 contexts (suppressed: 9 from 1) ==2120== ``` ## Luiz Fernando N. Capitulino, 2007-05-08 20:13 Subject: Re: git-http-fetch Segmentation fault Message-ID: <20070508171310.7e21f5ef@localhost> URL: https://gitlist.dev/e/20070508171310.7e21f5ef%40localhost In-Reply-To: <7vfy672iao.fsf@assigned-by-dhcp.cox.net> ``` Em Tue, 08 May 2007 13:04:47 -0700 Junio C Hamano escreveu: | "Luiz Fernando N. Capitulino" escreveu: | | > A friend of mine reported an easy to reproduce segmentation fault | > when cloning through http from his repository: | > | > """ | > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git | > got 299cdadd846913a052df361e973a947622f23198 | > walk 299cdadd846913a052df361e973a947622f23198 | > ... | > got 0ecd10d9d6ab020c2469a961777854afda705776 | > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1" | > """ | > | > Sometimes it shows up as a corrupted double-linked list, detected by | > glibc: | | Does not seem to reproduce for me on my x86_64 box nor an i386 | box I happened to have access to. Both run Debian etch. Forgot to say that you have to try a few times to reproduce. Boiko, can you try it on another distro? NSL maybe? I only run Mandriva on my machines. -- Luiz Fernando N. Capitulino ``` ## Luiz Fernando N. Capitulino, 2007-05-08 20:23 Subject: Re: git-http-fetch Segmentation fault Message-ID: <20070508172346.7a2dd910@localhost> URL: https://gitlist.dev/e/20070508172346.7a2dd910%40localhost In-Reply-To: <20070508171310.7e21f5ef@localhost> ``` Em Tue, 8 May 2007 17:13:10 -0300 "Luiz Fernando N. Capitulino" escreveu: | Em Tue, 08 May 2007 13:04:47 -0700 | Junio C Hamano escreveu: | | | "Luiz Fernando N. Capitulino" escreveu: | | | | > A friend of mine reported an easy to reproduce segmentation fault | | > when cloning through http from his repository: | | > | | > """ | | > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git | | > got 299cdadd846913a052df361e973a947622f23198 | | > walk 299cdadd846913a052df361e973a947622f23198 | | > ... | | > got 0ecd10d9d6ab020c2469a961777854afda705776 | | > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1" | | > """ | | > | | > Sometimes it shows up as a corrupted double-linked list, detected by | | > glibc: | | | | Does not seem to reproduce for me on my x86_64 box nor an i386 | | box I happened to have access to. Both run Debian etch. | | Forgot to say that you have to try a few times to reproduce. And, looks like you need http_proxy set too. Sorry for the bad report. :-| -- Luiz Fernando N. Capitulino ```