segfault in http-push

segfault in http-push

[Bob Copeland]

Hi,

With 1.4.5.2, I see this whenever I try to push a new branch over http:

$ git-push hash long_ids
Fetching remote heads...
  refs/
  refs/heads/
  refs/tags/
  refs/remotes/
updating 'refs/heads/long_ids'
  from 0000000000000000000000000000000000000000
  to   b24938890f04f3ba42b88f56f3ff2bbe0fda6629
    sending 10200 objects
    done
Updating remote server info
error: http-push died with strange error
error: failed to push to 'https://user@machine/foo.git/'

Here's a backtrace:

#0  0xb7cbd583 in strlen () from /lib/tls/i686/cmov/libc.so.6
#1  0x08053b5a in start_put (request=0xdce9ad8) at http-push.c:520
#2  0x080550d7 in fill_active_slot (unused=0x0) at http-push.c:810
#3  0x0804da9d in fill_active_slots () at http.c:428
#4  0x0804dc8b in step_active_slots () at http.c:454
#5  0x0804dd0b in run_active_slot (slot=0x8e70148) at http.c:474
#6  0x080502c9 in remote_ls (path=0x808bdbd "refs/", flags=5, 
    userFunc=0x804f2b0 <add_remote_info_ref>, userData=0xbfa04434)
    at http-push.c:1467
#7  0x08050552 in update_remote_info_refs (lock=0x80e66c0) at http-push.c:1942
#8  0x080534ee in main (argc=3, argv=Cannot access memory at address 0x4
) at http-push.c:2421

Error is at:
520             request->url = xmalloc(strlen(remote->url) +
521                                    strlen(request->lock->token) + 51);

(gdb) p request->lock
$1 = (struct remote_lock *) 0x80e7d40
(gdb) p request->lock->token
$2 = 0x65707954 <Address 0x65707954 out of bounds>

If I go fix up the remote repository I can usually get it to work.  
Any thoughts?

-- 
Bob Copeland %% www.bobcopeland.com

Re: segfault in http-push

[Johannes Schindelin]

Hi,

On Sun, 17 Feb 2008, Bob Copeland wrote:

> With 1.4.5.2, I see this whenever I try to push a new branch over http:

I can only suspect that you mean 1.5.4.2, not 1.4.5.2 (which I could not 
find).

Alas, a fix I provided for exactly this case did not make it into master 
yet, let alone into any released version.  Can you please test the current 
"next"?

FWIW, the fix is add8e8ce(http-push: avoid invalid memory accesses).

Thanks,
Dscho

Re: segfault in http-push

[Bob Copeland]

On Sun, Feb 17, 2008 at 11:23:38PM +0000, Johannes Schindelin wrote:
> I can only suspect that you mean 1.5.4.2, not 1.4.5.2 (which I could not 
> find).

Just so...

> Alas, a fix I provided for exactly this case did not make it into master 
> yet, let alone into any released version.  Can you please test the current 
> "next"?

Yep, next fixes it for me, thanks!

-- 
Bob Copeland %% www.bobcopeland.com 

Re: segfault in http-push

[Johannes Schindelin]

Hi,

On Sun, 17 Feb 2008, Bob Copeland wrote:

> On Sun, Feb 17, 2008 at 11:23:38PM +0000, Johannes Schindelin wrote:
> 
> > Alas, a fix I provided for exactly this case did not make it into 
> > master yet, let alone into any released version.  Can you please test 
> > the current "next"?
> 
> Yep, next fixes it for me, thanks!

Thanks for testing!

Ciao,
Dscho "who is pleased that we fix some bugs before they are reported"

Re: segfault in http-push

[Junio C Hamano]

Johannes Schindelin <Johannes.Schindelin@gmx.de> writes:

> Hi,
>
> On Sun, 17 Feb 2008, Bob Copeland wrote:
>
>> On Sun, Feb 17, 2008 at 11:23:38PM +0000, Johannes Schindelin wrote:
>> 
>> > Alas, a fix I provided for exactly this case did not make it into 
>> > master yet, let alone into any released version.  Can you please test 
>> > the current "next"?
>> 
>> Yep, next fixes it for me, thanks!
>
> Thanks for testing!
>
> Ciao,
> Dscho "who is pleased that we fix some bugs before they are reported"

Wonderful.

I take this as a go ahead to merge js/maint-http-push topic to 'maint'
before we cut 1.5.4.3.

Thanks both of you, especially Dscho.