Segmentation fault within git read-tree

Segmentation fault within git read-tree

[Frédéric Fort]

Hello,

I am doing some tests trying to do a sparse checkout of a partial clone 
within a subtree.
However, I get a segfault when trying to run git read-tree as is done by 
git subtree internally.

Maybe what I am doing isn't supposed to work at all, but I suppose it 
shouldn't at least cause git read-tree to segfault.

Here should be a MWE to reproduce my error:

# Run this to create the repo that will become your subtree
git init subtree.git
cd subtree.git
touch x y
git add .
git commit -m "first commit"

# Run this to create the repo that has a sparse checkout of a partial 
clone within a subtree
git init repo
cd repo
git commit --allow-empty "first commit"
git sparse-checkout set "subtree/x"
git remote add origin-subtree git@my.server:/with/the/subtree.git
git fetch --filter=blob:none origin-subtree
git rev-parse --verify "FETCH_HEAD^{commit}"
git read-tree --debug-unpack --prefix="subtree" FETCH_HEAD

Yours sincerely,
Frédéric Fort

Re: Segmentation fault within git read-tree

[Christian Couder]

Hi,

On Sat, Jan 14, 2023 at 11:22 PM Frédéric Fort <fortfrederic@free.fr> wrote:
>
> Hello,
>
> I am doing some tests trying to do a sparse checkout of a partial clone
> within a subtree.
> However, I get a segfault when trying to run git read-tree as is done by
> git subtree internally.
>
> Maybe what I am doing isn't supposed to work at all, but I suppose it
> shouldn't at least cause git read-tree to segfault.

Yeah, it shouldn't segfault. Thanks for the report!

> Here should be a MWE to reproduce my error:

I reproduced the issue using your steps with a few changes.

> # Run this to create the repo that will become your subtree
> git init subtree.git
> cd subtree.git
> touch x y
> git add .
> git commit -m "first commit"
>
> # Run this to create the repo that has a sparse checkout of a partial
> clone within a subtree
> git init repo
> cd repo
> git commit --allow-empty "first commit"

I think the above command is missing '-m' before "first commit".

> git sparse-checkout set "subtree/x"
> git remote add origin-subtree git@my.server:/with/the/subtree.git

I reproduced using a local remote like:

git remote add origin-subtree /path/to/subtree.git

> git fetch --filter=blob:none origin-subtree
> git rev-parse --verify "FETCH_HEAD^{commit}"
> git read-tree --debug-unpack --prefix="subtree" FETCH_HEAD

Yeah, I get the following under gdb:

Program received signal SIGSEGV, Segmentation fault.
debug_path (info=0x7fffffffc880) at unpack-trees.c:1395
1395                    if (*info->prev->name)
(gdb) bt
#0  debug_path (info=0x7fffffffc880) at unpack-trees.c:1395
#1  0x000055555587d917 in debug_unpack_callback (n=1, mask=1,
dirmask=0, names=0x7fffffffc3b0, info=0x7fffffffc880) at
unpack-trees.c:1417
#2  0x000055555587dc48 in unpack_callback (n=1, mask=1, dirmask=0,
names=0x7fffffffc3b0, info=0x7fffffffc880) at unpack-trees.c:1491
#3  0x00005555558779c2 in traverse_trees (istate=0x5555559f3b00
<the_index>, n=1, t=0x7fffffffcb50, info=0x7fffffffc880) at
tree-walk.c:536
#4  0x000055555587ef85 in unpack_trees (len=1, t=0x7fffffffcb50,
o=0x7fffffffcd90) at unpack-trees.c:1979
#5  0x000055555562ab45 in cmd_read_tree (argc=1, argv=0x7fffffffdc90,
cmd_prefix=0x0) at builtin/read-tree.c:263
#6  0x0000555555575a4d in run_builtin (p=0x5555559bf8f0
<commands+2256>, argc=4, argv=0x7fffffffdc90) at git.c:445
#7  0x0000555555575ed2 in handle_builtin (argc=4, argv=0x7fffffffdc90)
at git.c:700
#8  0x0000555555576179 in run_argv (argcp=0x7fffffffdaec,
argv=0x7fffffffdae0) at git.c:764
#9  0x0000555555576764 in cmd_main (argc=4, argv=0x7fffffffdc90) at git.c:899
#10 0x0000555555682dfe in main (argc=5, argv=0x7fffffffdc88) at common-main.c:57

From a very quick look, it seems that in setup_traverse_info() in
tree-walk.c we do:

    static struct traverse_info dummy;
...
    if (pathlen)
        info->prev = &dummy;

but then later in debug_path() in unpack-trees.c we check
*info->prev->name which segfaults.

I am not very familiar with this code and don't have much time right
now, so I think I will leave it to others to investigate this further.

Best,
Christian.

Re: Segmentation fault within git read-tree

[Jeff King]

On Sun, Jan 15, 2023 at 12:53:25PM +0100, Christian Couder wrote:

> From a very quick look, it seems that in setup_traverse_info() in
> tree-walk.c we do:
> 
>     static struct traverse_info dummy;
> ...
>     if (pathlen)
>         info->prev = &dummy;
> 
> but then later in debug_path() in unpack-trees.c we check
> *info->prev->name which segfaults.
> 
> I am not very familiar with this code and don't have much time right
> now, so I think I will leave it to others to investigate this further.

I'm not sure if Frédéric is seeing another segfault in practice (when
not using --debug-unpack), but yeah, it is very easy to trigger this
segfault. It does not even have to do with sparse checkouts, etc. Here's
an even more minimal example:

  git init repo
  cd repo
  touch file
  git add file
  git commit -m added
  git read-tree --debug-unpack --prefix=subtree HEAD

I was going to bisect, but it looks like it was broken all the way back
to Junio's ba655da537 (read-tree --debug-unpack, 2009-09-14).

-Peff

Re: Segmentation fault within git read-tree

[Junio C Hamano]

Jeff King <peff@peff.net> writes:

> I'm not sure if Frédéric is seeing another segfault in practice (when
> not using --debug-unpack), but yeah, it is very easy to trigger this
> segfault. It does not even have to do with sparse checkouts, etc. Here's
> an even more minimal example:
>
>   git init repo
>   cd repo
>   touch file
>   git add file
>   git commit -m added
>   git read-tree --debug-unpack --prefix=subtree HEAD
>
> I was going to bisect, but it looks like it was broken all the way back
> to Junio's ba655da537 (read-tree --debug-unpack, 2009-09-14).

As "git read-tree --help" does not even metnion "--debug-unpack", I
have no idea what it does, or how useful the debug information it
produces is.  As long as the same command without --debug-unpack
works OK, I'd throw this into "does it hurt? don't do it, then" bin.

;-)