kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

object-file: fix SEGV on free() regression in v2.34.0-rc2 

Fix a regression introduced in my 96e41f58fe (fsck: report invalid
object type-path combinations, 2021-10-01). When fsck-ing blobs larger
than core.bigFileThreshold, we'd free() a pointer to uninitialized
memory.

This issue would have been caught by SANITIZE=address, but since it
involves core.bigFileThreshold, none of the existing tests in our test
suite covered it.

Running them with the "big_file_threshold" in "environment.c" changed
to say "6" would have shown this failure, but let's add a dedicated
test for this scenario based on Han Xin's report[1].

The bug was introduced between v9 and v10[2] of the fsck series merged
in 061a21d36d (Merge branch 'ab/fsck-unexpected-type', 2021-10-25).

1. https://lore.kernel.org/git/20211111030302.75694-1-hanxin.hx@alibaba-inc.com/
2. https://lore.kernel.org/git/cover-v10-00.17-00000000000-20211001T091051Z-avarab@gmail.com/

Reported-by: Han Xin <chiyutianyi@gmail.com>
Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
maint
Ævar Arnfjörð Bjarmason 2021-11-11 06:18:55 +01:00 committed by Junio C Hamano
parent 96e41f58fe
commit 168a937bbc
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
object-file.c
View File

@ -2533,6 +2533,8 @@ int read_loose_object(const char *path,
char hdr[MAX_HEADER_LEN]; char hdr[MAX_HEADER_LEN];
unsigned long *size = oi->sizep; unsigned long *size = oi->sizep;


*contents = NULL;

map = map_loose_object_1(the_repository, path, NULL, &mapsize); map = map_loose_object_1(the_repository, path, NULL, &mapsize);
if (!map) { if (!map) {
error_errno(_("unable to mmap %s"), path); error_errno(_("unable to mmap %s"), path);

8
t/t1050-large.sh
View File

@ -17,6 +17,14 @@ test_expect_success setup '
export GIT_ALLOC_LIMIT export GIT_ALLOC_LIMIT
' '


test_expect_success 'enter "large" codepath, with small core.bigFileThreshold' '
test_when_finished "rm -rf repo" &&

git init --bare repo &&
echo large | git -C repo hash-object -w --stdin &&
git -C repo -c core.bigfilethreshold=4 fsck
'

# add a large file with different settings # add a large file with different settings
while read expect config while read expect config
do do