segfault for git log --graph --no-walk --grep a

[Thomas Haller <thom311@gmail.com>]

[-- Attachment #1: Type: Text/Plain, Size: 2062 bytes --]

Hallo,


I just found that git crashes with a segmentation fault when calling
$ git log --graph --no-walk --grep pattern

It happens both for version 1.7.10.4 from Debian (wheezy,amd64) and
a fresh compiled git from github (git.git repository, master).


For the error to occure, the pattern must match the commit message in HEAD.




How to reproduce:
  git init .
  git commit -m 'text1' --allow-empty
  git commit -m 'text2' --allow-empty
  git log --graph --no-walk --grep 'text2'



And here is coredump I got:

Core was generated by `git log --graph --no-walk --grep text2'.
Program terminated with signal 11, Segmentation fault.
#0  __strlen_sse42 () at ../sysdeps/x86_64/multiarch/strlen-sse4.S:32
#1  0x00000000004cc13e in commit_match (opt=0x7fffbd0ee500, commit=0x216d1a8) at revision.c:2306
#2  get_commit_action (revs=0x7fffbd0ee500, commit=0x216d1a8) at revision.c:2338
#3  0x00000000004984b4 in graph_is_interesting (commit=<optimized out>, graph=<error reading variable: Unhandled dwarf expression opcode 0xfa>) at graph.c:330
#4  0x0000000000498569 in first_interesting_parent (graph=graph@entry=0x21629c0) at graph.c:369
#5  0x000000000049965e in graph_update (graph=0x21629c0, commit=<optimized out>) at graph.c:593
#6  0x00000000004cc7a9 in get_revision (revs=revs@entry=0x7fffbd0ee500) at revision.c:2580
#7  0x000000000043988a in cmd_log_walk (rev=rev@entry=0x7fffbd0ee500) at builtin/log.c:309
#8  0x000000000043a398 in cmd_log (argc=9, argv=0x2162930, prefix=0x0) at builtin/log.c:582
#9  0x0000000000405988 in run_builtin (argv=0x2162930, argc=9, p=0x751438) at git.c:281
#10 handle_internal_command (argc=9, argv=0x2162930) at git.c:443
#11 0x0000000000404df2 in run_argv (argv=0x7fffbd0eec00, argcp=0x7fffbd0eec0c) at git.c:489
#12 main (argc=9, argv=0x2162930) at git.c:564


it happens in file revision.c:2306 because "commit->buffer" is zero:

                retval = grep_buffer(&opt->grep_filter,
                                     commit->buffer, strlen(commit->buffer));





thank you all, for this awesome software.
Thomas

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 490 bytes --]