Re: [BUG] rebase: can write reflog with uninit. `action` string

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Peff

On 29/04/2025 22:51, Jeff King wrote:
On Tue, Apr 29, 2025 at 09:40:13PM +0200, Kristoffer Haugsbakk wrote:

On Tue, Apr 29, 2025, at 11:22, Phillip Wood wrote:
#0  run_git_commit (defmsg=0x555555babe70 "<repo path>/MERGE_MSG", opts=0x7fffffffc070, flags=0) at sequencer.c:1158

Thanks for the backtrace. It would be useful to know what's stored in
opts->ctx->reflog_message at this point if it's not too much trouble
please can you run "print *opts" and "print *opts->ctx" here.

Today I ran on f65182a99e5 (The ninth batch, 2025-04-24) at
sequencer.c:1148.  I was never able to reproduce this
`opts->ctx->reflog_message` having a weird value with GDB today.  The
reflog was also fine.

Then I ran without GDB and I got the weird reflog that I expected.

Have you tried building with "make SANITIZE=address,undefined"?

This is a wild guess, but since ctx->reflog_message is pointing to a
static strbuf, it could be a use after free if the strbuf is reallocated
due to another call to reflog_message(), but we are still holding the
old pointer via ctx->reflog_message.

Oh, nice insight. I'd forgotten we had callers of reflog_message() that didn't store the result in ctx->reflog_message. One of those callers is in do_reset() which due to the way the todo list gets constructed is likely to be called just before do_merge().

Thanks

Phillip




[Index of Archives]     [Linux Kernel Development]     [Gcc Help]     [IETF Annouce]     [DCCP]     [Netdev]     [Networking]     [Security]     [V4L]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux SCSI]     [Fedora Users]

  Powered by Linux