From 168a937bbcf74370267fe04f5368035948745baa Mon Sep 17 00:00:00 2001 From: =?utf8?q?=C3=86var=20Arnfj=C3=B6r=C3=B0=20Bjarmason?= Date: Thu, 11 Nov 2021 06:18:55 +0100 Subject: [PATCH] object-file: fix SEGV on free() regression in v2.34.0-rc2 MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Fix a regression introduced in my 96e41f58fe1 (fsck: report invalid object type-path combinations, 2021-10-01). When fsck-ing blobs larger than core.bigFileThreshold, we'd free() a pointer to uninitialized memory. This issue would have been caught by SANITIZE=address, but since it involves core.bigFileThreshold, none of the existing tests in our test suite covered it. Running them with the "big_file_threshold" in "environment.c" changed to say "6" would have shown this failure, but let's add a dedicated test for this scenario based on Han Xin's report[1]. The bug was introduced between v9 and v10[2] of the fsck series merged in 061a21d36d8 (Merge branch 'ab/fsck-unexpected-type', 2021-10-25). 1. https://lore.kernel.org/git/20211111030302.75694-1-hanxin.hx@alibaba-inc.com/ 2. https://lore.kernel.org/git/cover-v10-00.17-00000000000-20211001T091051Z-avarab@gmail.com/ Reported-by: Han Xin Signed-off-by: Ævar Arnfjörð Bjarmason Signed-off-by: Junio C Hamano --- object-file.c | 2 ++ t/t1050-large.sh | 8 ++++++++ 2 files changed, 10 insertions(+) diff --git a/object-file.c b/object-file.c index 4c258703a0..9213a51721 100644 --- a/object-file.c +++ b/object-file.c @@ -2533,6 +2533,8 @@ int read_loose_object(const char *path, char hdr[MAX_HEADER_LEN]; unsigned long *size = oi->sizep; + *contents = NULL; + map = map_loose_object_1(the_repository, path, NULL, &mapsize); if (!map) { error_errno(_("unable to mmap %s"), path); diff --git a/t/t1050-large.sh b/t/t1050-large.sh index 4bab6a513c..6bc1d76fb1 100755 --- a/t/t1050-large.sh +++ b/t/t1050-large.sh @@ -17,6 +17,14 @@ test_expect_success setup ' export GIT_ALLOC_LIMIT ' +test_expect_success 'enter "large" codepath, with small core.bigFileThreshold' ' + test_when_finished "rm -rf repo" && + + git init --bare repo && + echo large | git -C repo hash-object -w --stdin && + git -C repo -c core.bigfilethreshold=4 fsck +' + # add a large file with different settings while read expect config do -- 2.11.4.GIT