git for-each-ref crashes for %(body) with tags

git for-each-ref crashes for %(body) with tags

[Han-Wen Nienhuys]

Hi,

see gdb trace below.   Unfortunately, I don't have a repo that I can
readily share to demonstrate this.

(gdb) r for-each-ref --format '%(body)' refs/tags
..

Breakpoint 1, grab_sub_body_contents (val=<value optimized out>,
deref=0, obj=<value optimized out>, buf=0x8146ad0, sz=161)
    at builtin-for-each-ref.c:494
494                             v->s = xstrdup(bodypos);
(gdb) p bodypos
$10 = 0x0

(gdb) n
496                             v->s = xstrdup(subpos);
(gdb) n

Program received signal SIGSEGV, Segmentation fault.
0x4d9ff013 in strlen () from /lib/tls/i686/cmov/libc.so.6

-- 
Han-Wen Nienhuys - hanwen@xs4all.nl - http://www.xs4all.nl/~hanwen

Re: git for-each-ref crashes for %(body) with tags

[Junio C Hamano]

"Han-Wen Nienhuys" <hanwenn@gmail.com> writes:

> see gdb trace below.   Unfortunately, I don't have a repo that I can
> readily share to demonstrate this.

You have a tag that has a single incomplete line as its payload.  The
attached patch should fix it, but I wonder how you created such an unusual
(I would not say "broken") tag to begin with?


diff --git i/builtin-for-each-ref.c w/builtin-for-each-ref.c
index 445039e..4d25ec5 100644
--- i/builtin-for-each-ref.c
+++ w/builtin-for-each-ref.c
@@ -459,8 +459,10 @@ static void find_subpos(const char *buf, unsigned long sz, const char **sub, con
 		return;
 	*sub = buf; /* first non-empty line */
 	buf = strchr(buf, '\n');
-	if (!buf)
+	if (!buf) {
+		*body = "";
 		return; /* no body */
+	}
 	while (*buf == '\n')
 		buf++; /* skip blank between subject and body */
 	*body = buf;

Re: git for-each-ref crashes for %(body) with tags

[Han-Wen Nienhuys]

>From what I can see, the command responsible was

  git tag empty


it still works (v1.6.0):

$ git tag this-tag-has-no-body

$ git cat-file tag this-tag-has-no-body
fatal: git-cat-file this-tag-has-no-body: bad file

$ git cat-file commit this-tag-has-no-body |head -2
tree b51a1eb73af67d17f12114ed3e1e6f93d5adbaa8
parent 49e532412bbc84e4fb73f0862df61882dd7dbf89




On Wed, Aug 20, 2008 at 4:12 PM, Junio C Hamano <gitster@pobox.com> wrote:
> "Han-Wen Nienhuys" <hanwenn@gmail.com> writes:
>
>> see gdb trace below.   Unfortunately, I don't have a repo that I can
>> readily share to demonstrate this.
>
> You have a tag that has a single incomplete line as its payload.  The
> attached patch should fix it, but I wonder how you created such an unusual
> (I would not say "broken") tag to begin with?
>
>
> diff --git i/builtin-for-each-ref.c w/builtin-for-each-ref.c
> index 445039e..4d25ec5 100644
> --- i/builtin-for-each-ref.c
> +++ w/builtin-for-each-ref.c
> @@ -459,8 +459,10 @@ static void find_subpos(const char *buf, unsigned long sz, const char **sub, con
>                return;
>        *sub = buf; /* first non-empty line */
>        buf = strchr(buf, '\n');
> -       if (!buf)
> +       if (!buf) {
> +               *body = "";
>                return; /* no body */
> +       }
>        while (*buf == '\n')
>                buf++; /* skip blank between subject and body */
>        *body = buf;
>



-- 
Han-Wen Nienhuys - hanwen@xs4all.nl - http://www.xs4all.nl/~hanwen