From: Jeff King <peff@peff•net>
To: Junio C Hamano <gitster@pobox•com>
Cc: Kristoffer Haugsbakk <kristofferhaugsbakk@fastmail•com>,
Lauri Niskanen <ape@ape3000•com>,
git@vger•kernel.org, Patrick Steinhardt <ps@pks•im>
Subject: Re: [BUG] git stash show -p with invalid option aborts with double-free in show_stash() (strvec_clear)
Date: Fri, 19 Sep 2025 13:20:07 -0400 [thread overview]
Message-ID: <20250919172007.GA59895@coredump.intra.peff.net> (raw)
In-Reply-To: <xmqqldma5qha.fsf@gitster.g>
On Fri, Sep 19, 2025 at 09:58:25AM -0700, Junio C Hamano wrote:
> For completeness, here is how the other approach may look like, but
> I have made my share of off-by-one mistakes all over the place over
> the ears, so somebody else needs to lend an eyeball and check it for
> sanity.
I _thought_ there was an off-by-one at first, but I think what you have
is correct:
> + /*
> + * NULL out the leftover args we did not understand, which has
> + * shallow copies in earlier slots in the array.
> + */
> + while (left < argc--)
> + argv[argc] = NULL;
> return left;
We definitely want argv[left] to be NULL, which I thought at first did
not happen because of the "<". But because it is post-increment that
happens in the loop condition, it works.
I probably would have written:
while (left <= argc)
argv[argc--] = NULL;
which I think is the same (but I didn't test it, so it probably does
have an off-by-one!).
But really, I do not know that we need to NULL the whole thing. We have
given the caller the reduced argc. The only argv invariant we are
violating is that argv[argc] should be NULL (or in this case,
argv[left]). Anything after argv+left should be considered
uninitialized. So just:
argv[left] = NULL;
would be enough, I'd think.
> diff --git c/t/t3903-stash.sh w/t/t3903-stash.sh
> index 0bb4648e36..dd70deb3b3 100755
> --- c/t/t3903-stash.sh
> +++ w/t/t3903-stash.sh
> @@ -69,6 +69,11 @@ test_expect_success 'stash some dirty working directory' '
> setup_stash
> '
>
> +test_expect_success 'controlled error return on unrecognized option' '
> + test_expect_code 129 git stash show -p --no-such 2>usage &&
> + grep -e "^usage: git stash show" usage
> +'
This passes now, but fails with SANITIZE=leak. Along with a bunch of
other tests, as we are now overwriting entries in strvecs with NULL, so
it has no opportunity to free them. We need to respect the
setup_revision_opt to free.
I'm working up a few alternative patches.
-Peff
next prev parent reply other threads:[~2025-09-19 17:20 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-19 10:18 [BUG] git stash show -p with invalid option aborts with double-free in show_stash() (strvec_clear) Lauri Niskanen
2025-09-19 13:11 ` Kristoffer Haugsbakk
2025-09-19 16:00 ` Junio C Hamano
2025-09-19 16:48 ` Jeff King
2025-09-19 17:13 ` Junio C Hamano
2025-09-19 16:58 ` Junio C Hamano
2025-09-19 17:20 ` Jeff King [this message]
2025-09-19 18:15 ` Junio C Hamano
2025-09-19 19:56 ` Jeff King
2025-09-19 22:33 ` [PATCH 0/6] fixing double-frees and leaks via setup_revisions() Jeff King
2025-09-19 22:40 ` [PATCH 1/6] stash: tell setup_revisions() to free our allocated strings Jeff King
2025-09-22 15:45 ` Junio C Hamano
2025-09-22 19:05 ` Jeff King
2025-09-22 19:36 ` Junio C Hamano
2025-09-22 20:25 ` Jeff King
2025-09-22 21:26 ` Junio C Hamano
2025-09-23 0:48 ` Jeff King
2025-09-19 22:45 ` [PATCH 2/6] revision: manage memory ownership of argv in setup_revisions() Jeff King
2025-09-19 22:48 ` [PATCH 3/6] revision: add wrapper to setup_revisions() from a strvec Jeff King
2025-09-20 5:10 ` Eric Sunshine
2025-09-20 5:48 ` Jeff King
2025-09-19 22:49 ` [PATCH 4/6] treewide: use setup_revisions_from_strvec() when we have " Jeff King
2025-09-19 22:50 ` [PATCH 5/6] treewide: pass strvecs around for setup_revisions_from_strvec() Jeff King
2025-09-19 23:11 ` Jeff King
2025-09-19 22:51 ` [PATCH 6/6] revision: retain argv NULL invariant in setup_revisions() Jeff King
2025-09-19 23:07 ` Jeff King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250919172007.GA59895@coredump.intra.peff.net \
--to=peff@peff$(echo .)net \
--cc=ape@ape3000$(echo .)com \
--cc=git@vger$(echo .)kernel.org \
--cc=gitster@pobox$(echo .)com \
--cc=kristofferhaugsbakk@fastmail$(echo .)com \
--cc=ps@pks$(echo .)im \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox