[PATCH] diff: fix lstat() error handling in diff_populate_filespec()

[PATCH] diff: fix lstat() error handling in diff_populate_filespec()

[Andrey Okoshkin]

Add lstat() error handling not only for ENOENT case.
Otherwise uninitialised 'struct stat st' variable is used later in case of
lstat() non-ENOENT failure which leads to processing of rubbish values of
file mode ('S_ISLNK(st.st_mode)' check) or size ('xsize_t(st.st_size)').

Signed-off-by: Andrey Okoshkin <a.okoshkin@samsung.com>
---
Hello,

I've injected a fault to git binary with the internal tool for fault tolerance
evaluation: lstat() returns '-1' and errno is set to 'EACCES' at
diff_populate_filespec git/diff.c:2850.
In a real life it's very difficult to reproduce such behaviour.
I'm not sure why only ENOENT error of lstat() is considered as an error but passing
by other errno values leads to reading of uninitialized 'struct stat st' variable.
It means that the populated 'diff_filespec' structure may be incorrectly filled.

Also diff_populate_filespec() result is not checked at diff_filespec_is_binary() but
it seems OK there.

Best regards,
Andrey

 diff.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/diff.c b/diff.c
index 8406a8324..d737a78a1 100644
--- a/diff.c
+++ b/diff.c
@@ -2848,14 +2848,12 @@ int diff_populate_filespec(struct diff_filespec *s, unsigned int flags)
 		int fd;
 
 		if (lstat(s->path, &st) < 0) {
-			if (errno == ENOENT) {
-			err_empty:
-				err = -1;
-			empty:
-				s->data = (char *)"";
-				s->size = 0;
-				return err;
-			}
+		err_empty:
+			err = -1;
+		empty:
+			s->data = (char *)"";
+			s->size = 0;
+			return err;
 		}
 		s->size = xsize_t(st.st_size);
 		if (!s->size)
-- 
2.14.3

Re: [PATCH] diff: fix lstat() error handling in diff_populate_filespec()

[Junio C Hamano]

Andrey Okoshkin <a.okoshkin@samsung.com> writes:

> I'm not sure why only ENOENT error of lstat() is considered as an
> error but passing by other errno values leads to reading of
> uninitialized 'struct stat st' variable.  It means that the
> populated 'diff_filespec' structure may be incorrectly filled.

Entirely correct.  There is no fundamental reason to try special
casing ENOENT, unless we are clearing the "this is an error" bit
when the errno is ENOENT---but this code does not even do so.  All
errors are errors---we wanted to know the result of lstat() to carry
on, and we couldn't figure out the status.  We do not want to die
immediately (instead we want to show diffs for other paths), so
substituting the result with an empty string is the least bad thing
we can do at this point in the code.

Re: [PATCH] diff: fix lstat() error handling in diff_populate_filespec()

[Junio C Hamano]

Junio C Hamano <gitster@pobox.com> writes:

> Andrey Okoshkin <a.okoshkin@samsung.com> writes:
>
>> I'm not sure why only ENOENT error of lstat() is considered as an
>> error but passing by other errno values leads to reading of
>> uninitialized 'struct stat st' variable.  It means that the
>> populated 'diff_filespec' structure may be incorrectly filled.
>
> Entirely correct.  There is no fundamental reason to try special
> casing ENOENT, unless we are clearing the "this is an error" bit
> when the errno is ENOENT---but this code does not even do so.  All
> errors are errors---we wanted to know the result of lstat() to carry
> on, and we couldn't figure out the status.  We do not want to die
> immediately (instead we want to show diffs for other paths), so
> substituting the result with an empty string is the least bad thing
> we can do at this point in the code.

By the way, if the reason why we are hitting this lstat(2) (not the
reason why lstat(2) is failing) is not because !s->oid.valid
(i.e. we are reading the working tree side because that is what is
on one side of the comparison) but because reuse_worktree_file()
told us to (i.e. we actually are trying to fill the filespec with
the blob contents, but found that we have already the same content
in a working tree file and found it more efficient to read from
there, rather than doing the read_sha1_file() on the s->oid.hash),
it probably is better to fall back to the other side of the if/else
when we see an error from this lstat(2) and pretend as if we got
false from reuse_worktree_file().  

That would allow us continue with the correct information we
originally wanted to use; after all, reusing is merely an
optimization.