git-diff-tree crashes on ubuntu kernel git repository

git-diff-tree crashes on ubuntu kernel git repository

[Torgil Svensson]

Hi

It seems like git-diff-tree has some problems with moved files:

$ git-diff-tree -p --stat --summary -M
348f179e3195448cea49c98a79cce8c7f446ce26
343ca16424ba031b37e4df49afddaee098a8f347 | wc -l
*** glibc detected *** free(): invalid pointer: 0x12ecbbf0 ***
6101

As can be seen below there is some obvious error in the output just
prior to the crash:
 drivers/w1/{masters => }/ds_w1_bridge.c            |   38

This file is moved into "w1/masters" by commit
bd529cfb40c427d5b5aae0d315afb9f0a1da5e76

$ git --version
git version 1.3.3.g5e36

$ cat .git/remotes/origin
URL: git://git.kernel.org/pub/scm/linux/kernel/git/bcollins/ubuntu-2.6
Pull: refs/heads/master:refs/heads/origin

 $ gdb git-diff-tree
(gdb) run -p --stat --summary -M
348f179e3195448cea49c98a79cce8c7f446ce26
343ca16424ba031b37e4df49afddaee098a8f347

<...lots of files...>

 drivers/video/w100fb.c                             |  162
 drivers/video/w100fb.h                             |  748 -
 drivers/w1/Kconfig                                 |   62
 drivers/w1/Makefile                                |   10
 drivers/w1/{masters => }/ds_w1_bridge.c            |   38
*** glibc detected *** free(): invalid pointer: 0x12ecbbf0 ***

Program received signal SIGABRT, Aborted.
0xffffe410 in __kernel_vsyscall ()
(gdb) bt
#0  0xffffe410 in __kernel_vsyscall ()
#1  0xb7d7e9a1 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7d802b9 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0xb7db287a in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6
#4  0xb7db8fd4 in malloc_usable_size () from /lib/tls/i686/cmov/libc.so.6
#5  0xb7db934a in free () from /lib/tls/i686/cmov/libc.so.6
#6  0x08056902 in show_stats (data=0x8deff80) at diff.c:392
#7  0x08058466 in diff_flush (options=0x80686b0) at diff.c:1999
#8  0x0805b143 in log_tree_diff_flush (opt=0x8068680) at log-tree.c:82
#9  0x08049d11 in main (argc=0, argv=0xbfcf8a14) at diff-tree.c:130
(gdb)

As shown above I can easily recreate the crash if you want more info.
Thank you for a wonderful tool.

//Torgil

[PATCH] Avoid segfault in diff --stat rename output.

[Sean]

Signed-off-by: Sean Estabrooks <seanlkml@sympatico.ca>
---
 diff.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

On Tue, 23 May 2006 01:09:43 +0200
"Torgil Svensson" <torgil.svensson@gmail.com> wrote:

> Hi
> 
> It seems like git-diff-tree has some problems with moved files:
> 
> $ git-diff-tree -p --stat --summary -M
> 348f179e3195448cea49c98a79cce8c7f446ce26
> 343ca16424ba031b37e4df49afddaee098a8f347 | wc -l
> *** glibc detected *** free(): invalid pointer: 0x12ecbbf0 ***
> 6101


diff --git a/diff.c b/diff.c
index 7f35e59..a7bb9b9 100644
--- a/diff.c
+++ b/diff.c
@@ -237,7 +237,7 @@ static char *pprint_rename(const char *a
 		if (a_midlen < 0) a_midlen = 0;
 		if (b_midlen < 0) b_midlen = 0;
 
-		name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
+		name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
 		sprintf(name, "%.*s{%.*s => %.*s}%s",
 			pfx_length, a,
 			a_midlen, a + pfx_length,
-- 
1.3.GIT

Re: [PATCH] Avoid segfault in diff --stat rename output.

[Junio C Hamano]

Sean <seanlkml@sympatico.ca> writes:

> Signed-off-by: Sean Estabrooks <seanlkml@sympatico.ca>
> ---
>  diff.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/diff.c b/diff.c
> index 7f35e59..a7bb9b9 100644
> --- a/diff.c
> +++ b/diff.c
> @@ -237,7 +237,7 @@ static char *pprint_rename(const char *a
>  		if (a_midlen < 0) a_midlen = 0;
>  		if (b_midlen < 0) b_midlen = 0;
>  
> -		name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
> +		name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
>  		sprintf(name, "%.*s{%.*s => %.*s}%s",

Obviously correct given what the sprintf() that immediately
follows does.  Sheesh, what was I smoking back then.  *BLUSH*

Thanks.

Q: xasprintf

[Dmitry V. Levin]

[-- Attachment #1: Type: text/plain, Size: 519 bytes --]

Hi,

On Mon, May 22, 2006 at 06:02:39PM -0700, Junio C Hamano wrote:
> Sean <seanlkml@sympatico.ca> writes:
[...]
> > -		name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
> > +		name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
> >  		sprintf(name, "%.*s{%.*s => %.*s}%s",
> 
> Obviously correct given what the sprintf() that immediately
> follows does.  Sheesh, what was I smoking back then.  *BLUSH*

What about introducing xasprintf() to eliminate such issues?


-- 
ldv

[-- Attachment #2: Type: application/pgp-signature, Size: 191 bytes --]

Re: [PATCH] Avoid segfault in diff --stat rename output.

[Torgil Svensson]

This patch fixed the issue for me.

On 5/23/06, Sean <seanlkml@sympatico.ca> wrote:
>
> Signed-off-by: Sean Estabrooks <seanlkml@sympatico.ca>
> ---
>  diff.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
>
> On Tue, 23 May 2006 01:09:43 +0200
> "Torgil Svensson" <torgil.svensson@gmail.com> wrote:
>
> > Hi
> >
> > It seems like git-diff-tree has some problems with moved files:
> >
> > $ git-diff-tree -p --stat --summary -M
> > 348f179e3195448cea49c98a79cce8c7f446ce26
> > 343ca16424ba031b37e4df49afddaee098a8f347 | wc -l
> > *** glibc detected *** free(): invalid pointer: 0x12ecbbf0 ***
> > 6101
>
>
> diff --git a/diff.c b/diff.c
> index 7f35e59..a7bb9b9 100644
> --- a/diff.c
> +++ b/diff.c
> @@ -237,7 +237,7 @@ static char *pprint_rename(const char *a
>                 if (a_midlen < 0) a_midlen = 0;
>                 if (b_midlen < 0) b_midlen = 0;
>
> -               name = xmalloc(len_a + len_b - pfx_length - sfx_length + 7);
> +               name = xmalloc(pfx_length + a_midlen + b_midlen + sfx_length + 7);
>                 sprintf(name, "%.*s{%.*s => %.*s}%s",
>                         pfx_length, a,
>                         a_midlen, a + pfx_length,
> --
> 1.3.GIT
>
>