threads / patch / 9853

patch, 2 partsFix builtin-fetch memory corruption by not overstepping array

Subject: [RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array

## tl;dr

3 messages between Sep 14, 2007 and Sep 14, 2007. Diffs are folded; open one to read it.

replies: 2people: 2as markdown or json

Shawn O. Pearce· Sep 14, 2007, 22:59 UTC · lore

A long time ago Junio added this line to always ensure that the output array created by remove_duplicates() had a NULL as its terminating node. Today none of the downstream consumers of this array care about a NULL terminator; they only pay attention to the size of the array (as indicated by nr_heads). In (nearly?) all cases passing a NULL element will cause SIGSEGV failures. So this NULL terminal is not actually necessary.

Unfortunately we cannot continue to NULL terminate the array at this point as the array may only have been allocated large enough to match the input of nr_heads. If there are no duplicates than we would be trying to store NULL into heads[nr_heads] and that may be outside of the array.

My recent series to cleanup builtin-fetch changed the allocation of the heads array from 256 entries to exactly nr_heads thus ensuring we were always overstepping the array and causing memory corruption.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>
---

 *** RESEND TO CORRECT FROM+SBO ***

 Sorry Junio.  I realized too late that the headers were wrong.
 That's what I get for not configuring ~/.gitconfig on my amd64
 Linux box.  ;-)

 builtin-fetch-pack.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)

Show changes to builtin-fetch-pack.c +0 −1

diff --git a/builtin-fetch-pack.c b/builtin-fetch-pack.c
index b0936cc..2977a94 100644
--- a/builtin-fetch-pack.c
+++ b/builtin-fetch-pack.c
@@ -654,7 +654,6 @@ static int remove_duplicates(int nr_heads, char **heads)
 			heads[dst] = heads[src];
 		dst++;
 	}
-	heads[dst] = 0;
 	return dst;
 }

-- 
1.5.3.1.921.g8c3b

Shawn O. Pearce· Sep 14, 2007, 23:14 UTC · re: Shawn O. Pearce · lore

Re: [RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array

"Shawn O. Pearce" <spearce@spearce.org> wrote:

Show 5 quoted lines

> Unfortunately we cannot continue to NULL terminate the array at
> this point as the array may only have been allocated large enough
> to match the input of nr_heads.  If there are no duplicates than
> we would be trying to store NULL into heads[nr_heads] and that may
> be outside of the array.

...

Show 12 quoted lines

> diff --git a/builtin-fetch-pack.c b/builtin-fetch-pack.c
> index b0936cc..2977a94 100644
> --- a/builtin-fetch-pack.c
> +++ b/builtin-fetch-pack.c
> @@ -654,7 +654,6 @@ static int remove_duplicates(int nr_heads, char **heads)
>  			heads[dst] = heads[src];
>  		dst++;
>  	}
> -	heads[dst] = 0;
>  	return dst;
>  }
>

This fortunately does not appear to be a bug in `maint`, `master`, or `next`. It appears to be isolated to the builtin-fetch topic. The builtin-fetch topic changed fetch-pack to be builtin-fetch-pack and in doing so changed things such that the heads array might not have room for this final entry.

In maint/master/next the heads array is actually backed by the argv passed into main by the kernel, and that does have an existing NULL terminator, which the above "heads[dst] = 0" is simply going to overwrite if "heads == nr_heads".

-- 
Shawn.

Junio C Hamano· Sep 14, 2007, 23:43 UTC · re: Shawn O. Pearce · lore

Re: [RESEND PATCH 1/2] Fix builtin-fetch memory corruption by not overstepping array

"Shawn O. Pearce" <spearce@spearce.org> writes:

Show 5 quoted lines

>  *** RESEND TO CORRECT FROM+SBO ***
>
>  Sorry Junio.  I realized too late that the headers were wrong.
>  That's what I get for not configuring ~/.gitconfig on my amd64
>  Linux box.  ;-)

Actually this might have been a good thing, according to Linus. It is an evidence that you built and tested that change on the "blink" box not your usual box.