git-http-fetch Segmentation fault

git-http-fetch Segmentation fault

[Luiz Fernando N. Capitulino]

 Hi,

 A friend of mine reported an easy to reproduce segmentation fault
when cloning through http from his repository:

"""
~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
got 299cdadd846913a052df361e973a947622f23198
walk 299cdadd846913a052df361e973a947622f23198
...
got 0ecd10d9d6ab020c2469a961777854afda705776
/home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault      (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
"""

 Sometimes it shows up as a corrupted double-linked list, detected by
glibc:

"""
*** glibc detected *** git-http-fetch: corrupted double-linked list: 0x080a5680 ***
"""

 It's reproducible with Junio's master and maint branches (3082ac and
53a582 respectivelly).

 BTW, At line 406 (the trap command), git-clone script removes the
directory it was fetching. This removes the core dump file too.
We should not remove the directory if there's a core dump in there.

-- 
Luiz Fernando N. Capitulino

Re: git-http-fetch Segmentation fault

[Junio C Hamano]

"Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:

>  A friend of mine reported an easy to reproduce segmentation fault
> when cloning through http from his repository:
>
> """
> ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
> got 299cdadd846913a052df361e973a947622f23198
> walk 299cdadd846913a052df361e973a947622f23198
> ...
> got 0ecd10d9d6ab020c2469a961777854afda705776
> /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault      (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
> """
>
>  Sometimes it shows up as a corrupted double-linked list, detected by
> glibc:

Does not seem to reproduce for me on my x86_64 box nor an i386
box I happened to have access to.  Both run Debian etch.

Here is an excerpt from a valgrind run on the x86_64 box.  It
does seem to find a handful "problematic" accesses, but all seem
to be in the system libraries.  I did not get any errors on the
i386 box.

: gitster v/master; valgrind git-http-fetch -v -a -w remotes/origin/master 299cdadd846913a052df361e973a947622f23198 http://people.mandriva.com/~boiko/mandrivamenu.git/

==2120== Conditional jump or move depends on uninitialised value(s)
==2120==    at 0x4010AEE: (within /lib/ld-2.3.6.so)
==2120==    by 0x4006CB6: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FF260: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so)
==2120==    by 0x5201497: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so)
==2120==    by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so)
==2120==    by 0x51B6FCE: (within /lib/libc-2.3.6.so)
==2120==    by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so)
==2120==    by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0)
==2120== 
==2120== Conditional jump or move depends on uninitialised value(s)
==2120==    at 0x4010AF9: (within /lib/ld-2.3.6.so)
==2120==    by 0x4006CB6: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FF260: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so)
==2120==    by 0x5201497: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so)
==2120==    by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so)
==2120==    by 0x51B6FCE: (within /lib/libc-2.3.6.so)
==2120==    by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so)
==2120==    by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0)
==2120== 
==2120== Conditional jump or move depends on uninitialised value(s)
==2120==    at 0x4010B04: (within /lib/ld-2.3.6.so)
==2120==    by 0x4006CB6: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FF260: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so)
==2120==    by 0x5201497: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so)
==2120==    by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so)
==2120==    by 0x51B6FCE: (within /lib/libc-2.3.6.so)
==2120==    by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so)
==2120==    by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0)
==2120== 
==2120== Conditional jump or move depends on uninitialised value(s)
==2120==    at 0x4010C61: (within /lib/ld-2.3.6.so)
==2120==    by 0x4006E47: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FF260: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so)
==2120==    by 0x5201497: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so)
==2120==    by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so)
==2120==    by 0x51B6FCE: (within /lib/libc-2.3.6.so)
==2120==    by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so)
==2120==    by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0)
==2120== 
==2120== Invalid read of size 8
==2120==    at 0x4010C54: (within /lib/ld-2.3.6.so)
==2120==    by 0x4008D38: (within /lib/ld-2.3.6.so)
==2120==    by 0x4004CF2: (within /lib/ld-2.3.6.so)
==2120==    by 0x4006D6C: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FF260: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so)
==2120==    by 0x5201497: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so)
==2120==    by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so)
==2120==    by 0x51B6FCE: (within /lib/libc-2.3.6.so)
==2120==  Address 0x5F096F0 is 16 bytes inside a block of size 23 alloc'd
==2120==    at 0x4A1B858: malloc (vg_replace_malloc.c:149)
==2120==    by 0x4007113: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FF260: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so)
==2120==    by 0x5201497: (within /lib/libc-2.3.6.so)
==2120==    by 0x400B7D0: (within /lib/ld-2.3.6.so)
==2120==    by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so)
==2120==    by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so)
==2120==    by 0x51B6FCE: (within /lib/libc-2.3.6.so)
==2120==    by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so)
==2120==    by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0)
...
==2120== 
==2120== IN SUMMARY: 6 errors from 5 contexts (suppressed: 9 from 1)
==2120== 

Re: git-http-fetch Segmentation fault

[Luiz Fernando N. Capitulino]

Em Tue, 08 May 2007 13:04:47 -0700
Junio C Hamano <junkio@cox.net> escreveu:

| "Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:
| 
| >  A friend of mine reported an easy to reproduce segmentation fault
| > when cloning through http from his repository:
| >
| > """
| > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
| > got 299cdadd846913a052df361e973a947622f23198
| > walk 299cdadd846913a052df361e973a947622f23198
| > ...
| > got 0ecd10d9d6ab020c2469a961777854afda705776
| > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault      (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
| > """
| >
| >  Sometimes it shows up as a corrupted double-linked list, detected by
| > glibc:
| 
| Does not seem to reproduce for me on my x86_64 box nor an i386
| box I happened to have access to.  Both run Debian etch.

 Forgot to say that you have to try a few times to reproduce.

 Boiko, can you try it on another distro? NSL maybe? I only run
Mandriva on my machines.

-- 
Luiz Fernando N. Capitulino

Re: git-http-fetch Segmentation fault

[Luiz Fernando N. Capitulino]

Em Tue, 8 May 2007 17:13:10 -0300
"Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:

| Em Tue, 08 May 2007 13:04:47 -0700
| Junio C Hamano <junkio@cox.net> escreveu:
| 
| | "Luiz Fernando N. Capitulino" <lcapitulino@mandriva.com.br> escreveu:
| | 
| | >  A friend of mine reported an easy to reproduce segmentation fault
| | > when cloning through http from his repository:
| | >
| | > """
| | > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
| | > got 299cdadd846913a052df361e973a947622f23198
| | > walk 299cdadd846913a052df361e973a947622f23198
| | > ...
| | > got 0ecd10d9d6ab020c2469a961777854afda705776
| | > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault      (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
| | > """
| | >
| | >  Sometimes it shows up as a corrupted double-linked list, detected by
| | > glibc:
| | 
| | Does not seem to reproduce for me on my x86_64 box nor an i386
| | box I happened to have access to.  Both run Debian etch.
| 
|  Forgot to say that you have to try a few times to reproduce.

 And, looks like you need http_proxy set too.

 Sorry for the bad report. :-|

-- 
Luiz Fernando N. Capitulino