From patchwork Sun Mar 14 18:47:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137897 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF5A4C433E9 for ; Sun, 14 Mar 2021 18:48:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8096964EB3 for ; Sun, 14 Mar 2021 18:48:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234065AbhCNSsQ (ORCPT ); Sun, 14 Mar 2021 14:48:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52076 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231892AbhCNSrp (ORCPT ); Sun, 14 Mar 2021 14:47:45 -0400 Received: from mail-wm1-x32e.google.com (mail-wm1-x32e.google.com [IPv6:2a00:1450:4864:20::32e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4221FC061762 for ; Sun, 14 Mar 2021 11:47:45 -0700 (PDT) Received: by mail-wm1-x32e.google.com with SMTP id c76-20020a1c9a4f0000b029010c94499aedso18951960wme.0 for ; Sun, 14 Mar 2021 11:47:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=VRVig6r2OQ7VUMmLKHIM+DZFPJ7DwZl4ljHRZhrvI1M=; b=hffnrqEZMWdIqwn+b0gEGp7tmaWoXp/UvBqYJXN/Vsj8a21GQ4nWoXEn+LTU/3rEaV ChfCmpwUYwJkwfM2G/XMJkIRHzt0FJz3kT5pJ+mio4LcB8nNoukxUle+9LPQspFCtm03 ppvNTxYLekcLew97gVd6U9O3azeRWJQutcVw8rY1aJmTibCfLnEYcJyTl5UnTTDyySZb zxwh5OUeWdiyYrBk8rsLkdlzsvnk8Euu4e7MLrP5JpI2qXSpxz+RaunLceFrJ1nMq+15 pClhOyV1kw/wxPAPC27NTcgrpvzP2eNF08sb8Yn4Gfbd3L25qDdwBTkbXTdG+ctL1TLU s/wQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=VRVig6r2OQ7VUMmLKHIM+DZFPJ7DwZl4ljHRZhrvI1M=; b=J5Vo2zkAdTZGnSIEDI1egRhTvxgiWxaYx3IHVEb8Urbp6ec33doUF9SopQHVCWvYOF 2q137W8yfAPUNyO9nUR1DNQqpxNAJZnM4QD4ZgKSpK9Ec6SQq7UhEbgCzniSHQ06SQLC SImt+ftADxzewBe3BV4G56KpEw5cCs5uoJZYAQV/r2HISNDSrafqgkVY7OyQWVavatez EMykn9WKykdeF0SbX21sTjG0OYHgdIwSPEdADt3mer37o09jkP7V62FuuOn6jpTQMtb1 lNcy5+t2Gl5YGifwF0jUmAfVRWeSLlf2dd4MmdvVtEJPIL1Q22Yj2uwc1Jf6e21+pMnV TT4g== X-Gm-Message-State: AOAM530c+dOB8L+2wBjds7GHIlONU6D92KMcmZSDpnt8vpH4kaWoFncc KtY93D2b7Fsz951fZSm/+Os0TH4F0p4= X-Google-Smtp-Source: ABdhPJyyTA4vwhk1wpQB1za2L3Q0qpmiqJqfItufH7Qqds0s3s1z9rgNjqWwQp84El6ZFyYqKWxf6Q== X-Received: by 2002:a1c:bac2:: with SMTP id k185mr23135796wmf.148.1615747664065; Sun, 14 Mar 2021 11:47:44 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id d13sm16811042wro.23.2021.03.14.11.47.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:43 -0700 (PDT) Message-Id: In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:34 +0000 Subject: [PATCH v2 1/9] symbolic-ref: don't leak shortened refname in check_symref() Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt shorten_unambiguous_ref() returns an allocated string. We have to track it separately from the const refname. This leak has existed since: 9ab55daa55 (git symbolic-ref --delete $symref, 2012-10-21) This leak was found when running t0001 with LSAN, see also LSAN output below: Direct leak of 19 byte(s) in 1 object(s) allocated from: #0 0x486514 in strdup /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_interceptors.cpp:452:3 #1 0x9ab048 in xstrdup /home/ahunt/oss-fuzz/git/wrapper.c:29:14 #2 0x8b452f in refs_shorten_unambiguous_ref /home/ahunt/oss-fuzz/git/refs.c #3 0x8b47e8 in shorten_unambiguous_ref /home/ahunt/oss-fuzz/git/refs.c:1287:9 #4 0x679fce in check_symref /home/ahunt/oss-fuzz/git/builtin/symbolic-ref.c:28:14 #5 0x679ad8 in cmd_symbolic_ref /home/ahunt/oss-fuzz/git/builtin/symbolic-ref.c:70:9 #6 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #7 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #8 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #9 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #10 0x69cc6e in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #11 0x7f98388a4349 in __libc_start_main (/lib64/libc.so.6+0x24349) Signed-off-by: Andrzej Hunt --- builtin/symbolic-ref.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/builtin/symbolic-ref.c b/builtin/symbolic-ref.c index 80237f0df10f..e547a08d6c7c 100644 --- a/builtin/symbolic-ref.c +++ b/builtin/symbolic-ref.c @@ -24,9 +24,11 @@ static int check_symref(const char *HEAD, int quiet, int shorten, int print) return 1; } if (print) { + char *to_free = NULL; if (shorten) - refname = shorten_unambiguous_ref(refname, 0); + refname = to_free = shorten_unambiguous_ref(refname, 0); puts(refname); + free(to_free); } return 0; } From patchwork Sun Mar 14 18:47:35 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137909 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AF4CC43331 for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0C16164EB0 for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234179AbhCNSsY (ORCPT ); Sun, 14 Mar 2021 14:48:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52086 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233756AbhCNSrr (ORCPT ); Sun, 14 Mar 2021 14:47:47 -0400 Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E3E23C061763 for ; Sun, 14 Mar 2021 11:47:45 -0700 (PDT) Received: by mail-wr1-x434.google.com with SMTP id k8so4590819wrc.3 for ; Sun, 14 Mar 2021 11:47:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=F0opQpe7BV1fXWQ5HltcF7A+GqCj/k0iJf9Vz5xKxgw=; b=BDvTVB79W5uTULEjeu1Sx93QPW+bBs1IEmfsdVFYM+LnJTHleWyZn9KI7pSStRLOjY TsyzKytwISCrk9FyQ9QuIGu7CSnHQZ0dP5/0ujjGxS2JMlrcCnpBXpkUa0XyrxXHlEyR CnuLB4Ua2Uwoq4yDexnxc29/f8iQgqZLqUQ6BbOucBlHAp5vrMwssafUejRQum6Oy6fM FqoAZGcJwqnvkOWps/2eRzPba1UMdcPQzZNOMcHqHsP4+CCI6lE3syyD0UR2QCn5SnYt ghBRAVvrONBe/XkGM1H2e1uLNa7hki+XXfPBiUtmtrMFzgHxX/cUvA0dIU189TKLNig3 GdDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=F0opQpe7BV1fXWQ5HltcF7A+GqCj/k0iJf9Vz5xKxgw=; b=bM39pdOwMo65JxuXCRVaMcK7CRW72e7E3o7zPg9W+MCchulUPBrDjwFlu8QYHkssPt bGgZCOaHWUvYGnACMYkS6qAj6KYJVggTJkNAJmPH44L2lIAYSHEk1j9gkSgNAaO7P28s 7Y1uNC/XCF2W8Yv/9r/rOocZuxOCXueAY8rr5dCc0O7nMG6ubIJT3GzRNFsqK7WoCJ1M UExK3racq8TR4f6Hb3LrbzQeajSiFZvz+wtcbHY92jhD6qd9LPR8W10zi9pwNq7zNbse 3bmnUh3lktya+KuiTfK4enJt76kEwL28Yw9+VWqm5mh5KbZA2iuZ5uRiz2TxbM2RWjys fvtQ== X-Gm-Message-State: AOAM53038OSm7q/jFY3SHDa7yZrCpVwzfBu5d0+pumZ07Xx1aiBNUjcM s8ORs2ehlpubq0RmFt58FdI88rHnNtM= X-Google-Smtp-Source: ABdhPJwjiF/evYXiSG1u53hIu/WSOohbaSVJ1Q2+ozXXT/Bx9Fi9UVhrN3QJuFKyLEFX0RI2/7uzag== X-Received: by 2002:a5d:698e:: with SMTP id g14mr23612077wru.127.1615747664553; Sun, 14 Mar 2021 11:47:44 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id l22sm16324996wrb.4.2021.03.14.11.47.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:44 -0700 (PDT) Message-Id: In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:35 +0000 Subject: [PATCH v2 2/9] reset: free instead of leaking unneeded ref Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt dwim_ref() allocs a new string into ref. Instead of setting to NULL to discard it, we can FREE_AND_NULL. This leak appears to have been introduced in: 4cf76f6bbf (builtin/reset: compute checkout metadata for reset, 2020-03-16) This leak was found when running t0001 with LSAN, see also LSAN output below: Direct leak of 5 byte(s) in 1 object(s) allocated from: #0 0x486514 in strdup /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_interceptors.cpp:452:3 #1 0x9a7108 in xstrdup /home/ahunt/oss-fuzz/git/wrapper.c:29:14 #2 0x8add6b in expand_ref /home/ahunt/oss-fuzz/git/refs.c:670:12 #3 0x8ad777 in repo_dwim_ref /home/ahunt/oss-fuzz/git/refs.c:644:22 #4 0x6394af in dwim_ref /home/ahunt/oss-fuzz/git/./refs.h:162:9 #5 0x637e5c in cmd_reset /home/ahunt/oss-fuzz/git/builtin/reset.c:426:4 #6 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #7 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #8 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #9 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #10 0x69c5ce in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #11 0x7f57ebb9d349 in __libc_start_main (/lib64/libc.so.6+0x24349) Signed-off-by: Andrzej Hunt --- builtin/reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/builtin/reset.c b/builtin/reset.c index c635b062c3a7..43e855cb8876 100644 --- a/builtin/reset.c +++ b/builtin/reset.c @@ -425,7 +425,7 @@ int cmd_reset(int argc, const char **argv, const char *prefix) dwim_ref(rev, strlen(rev), &dummy, &ref, 0); if (ref && !starts_with(ref, "refs/")) - ref = NULL; + FREE_AND_NULL(ref); err = reset_index(ref, &oid, reset_type, quiet); if (reset_type == KEEP && !err) From patchwork Sun Mar 14 18:47:36 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137907 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14807C43332 for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EE14B64EB3 for ; Sun, 14 Mar 2021 18:48:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234147AbhCNSsX (ORCPT ); Sun, 14 Mar 2021 14:48:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52088 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233779AbhCNSrr (ORCPT ); Sun, 14 Mar 2021 14:47:47 -0400 Received: from mail-wr1-x435.google.com (mail-wr1-x435.google.com [IPv6:2a00:1450:4864:20::435]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 63F8CC061574 for ; Sun, 14 Mar 2021 11:47:46 -0700 (PDT) Received: by mail-wr1-x435.google.com with SMTP id v15so7594510wrx.4 for ; Sun, 14 Mar 2021 11:47:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=n4+S2Pqpnjccom1Dygbobupx9Ufrm4jBnm7Kzcw1WCE=; b=FuBGY1rQEy61ISHd1l9wj4cyZsWpDzzjfw3h0WhP2hiqrLMbsMOA0RyKXKDU64N0WI GS9eKHCtCnDoOkkXX8crJYt7ejTEVmJ8C/xGQjVu9oveDJziZBg+4uKTN5xbLAkv7X5L C4Dz/NXCi4flWnUpzsVdmoNcAFfXozK26IKnJXmDkE5jVNJaOdQaIogZdE7JPq/wJwmv MVbVu1ienqpRNVKGDBKH8LjGODmiQP1YKVDHl7m3+7V8T/vfNpLVYuG5l0Ojzb7FE7M9 G8+yUR+a6nkdw3C9NTLya8f1l1gMDxPovHJZFBRxxj8YwWZgF9uebxv9XcPe5V9a4jft GrOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=n4+S2Pqpnjccom1Dygbobupx9Ufrm4jBnm7Kzcw1WCE=; b=ru64RhmFc6OFb4/4RxM5jJ4D0LoM+lwgE7CSAc2aAK7BCs8pds3dLAw0bTTeRXToar 9uS0vBZjqCzX+UBVlcGJUZvBRNOFT6j2z1WmHAEfI/4dA+q37rZ52Xbxj26J3ZS4h3Q2 OpsjyzGMZEbIWNgpT7g4HeEXpznBuUl32+aIjszfSPOmc4DRPHbcOyKNSKxNXrN82F64 Li7JgxwMBkL5/BZDdx3bBUnvHmHTPN/XL8fbshuD4bcW7lH85GyRfcaFNlFFcVVi0ZZo qVQ0IHEBo35BMxml1Uxwp2Yw+alFDmFbIHRpUjaYO1RAs+Q0eDZZq20djwfclGd37NdN vgqw== X-Gm-Message-State: AOAM531+WWmx8Kei/sj9h6ZN8TjK5Fwk8zh3wzhaA6+l1h63+opot3DR PuxTqqp2mUkLskjoz4ANjDP0uLv/koA= X-Google-Smtp-Source: ABdhPJwOJNpT2uCzEd/Z9ijixIHZnaBtTMsAvc3e18JgSt79IXoZ3Ea61xAXAv8JhGB8/kuY8JuE6w== X-Received: by 2002:a5d:6411:: with SMTP id z17mr23559068wru.119.1615747665127; Sun, 14 Mar 2021 11:47:45 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id j12sm16153125wrx.59.2021.03.14.11.47.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:44 -0700 (PDT) Message-Id: In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:36 +0000 Subject: [PATCH v2 3/9] clone: free or UNLEAK further pointers when finished Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt Most of these pointers can safely be freed when cmd_clone() completes, therefore we make sure to free them. The one exception is that we have to UNLEAK(repo) because it can point either to argv[0], or a malloc'd string returned by absolute_pathdup(). We also have to free(path) in the middle of cmd_clone(): later during cmd_clone(), path is unconditionally overwritten with a different path, triggering a leak. Freeing the first path immediately after use (but only in the case where it contains data) seems like the cleanest solution, as opposed to freeing it unconditionally before path is reused for another path. This leak appears to have been introduced in: f38aa83f9a (use local cloning if insteadOf makes a local URL, 2014-07-17) These leaks were found when running t0001 with LSAN, see also an excerpt of the LSAN output below (the full list is omitted because it's far too long, and mostly consists of indirect leakage of members of the refs we are freeing). Direct leak of 178 byte(s) in 1 object(s) allocated from: #0 0x49a53d in malloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 #1 0x9a6ff4 in do_xmalloc /home/ahunt/oss-fuzz/git/wrapper.c:41:8 #2 0x9a6fca in xmalloc /home/ahunt/oss-fuzz/git/wrapper.c:62:9 #3 0x8ce296 in copy_ref /home/ahunt/oss-fuzz/git/remote.c:885:8 #4 0x8d2ebd in guess_remote_head /home/ahunt/oss-fuzz/git/remote.c:2215:10 #5 0x51d0c5 in cmd_clone /home/ahunt/oss-fuzz/git/builtin/clone.c:1308:4 #6 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #7 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #8 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #9 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #10 0x69c45e in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #11 0x7f6a459d5349 in __libc_start_main (/lib64/libc.so.6+0x24349) Direct leak of 165 byte(s) in 1 object(s) allocated from: #0 0x49a53d in malloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 #1 0x9a6fc4 in do_xmalloc /home/ahunt/oss-fuzz/git/wrapper.c:41:8 #2 0x9a6f9a in xmalloc /home/ahunt/oss-fuzz/git/wrapper.c:62:9 #3 0x8ce266 in copy_ref /home/ahunt/oss-fuzz/git/remote.c:885:8 #4 0x51e9bd in wanted_peer_refs /home/ahunt/oss-fuzz/git/builtin/clone.c:574:21 #5 0x51cfe1 in cmd_clone /home/ahunt/oss-fuzz/git/builtin/clone.c:1284:17 #6 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #7 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #8 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #9 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #10 0x69c42e in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #11 0x7f8fef0c2349 in __libc_start_main (/lib64/libc.so.6+0x24349) Direct leak of 178 byte(s) in 1 object(s) allocated from: #0 0x49a53d in malloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3 #1 0x9a6ff4 in do_xmalloc /home/ahunt/oss-fuzz/git/wrapper.c:41:8 #2 0x9a6fca in xmalloc /home/ahunt/oss-fuzz/git/wrapper.c:62:9 #3 0x8ce296 in copy_ref /home/ahunt/oss-fuzz/git/remote.c:885:8 #4 0x8d2ebd in guess_remote_head /home/ahunt/oss-fuzz/git/remote.c:2215:10 #5 0x51d0c5 in cmd_clone /home/ahunt/oss-fuzz/git/builtin/clone.c:1308:4 #6 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #7 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #8 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #9 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #10 0x69c45e in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #11 0x7f6a459d5349 in __libc_start_main (/lib64/libc.so.6+0x24349) Direct leak of 165 byte(s) in 1 object(s) allocated from: #0 0x49a6b2 in calloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 #1 0x9a72f2 in xcalloc /home/ahunt/oss-fuzz/git/wrapper.c:140:8 #2 0x8ce203 in alloc_ref_with_prefix /home/ahunt/oss-fuzz/git/remote.c:867:20 #3 0x8ce1a2 in alloc_ref /home/ahunt/oss-fuzz/git/remote.c:875:9 #4 0x72f63e in process_ref_v2 /home/ahunt/oss-fuzz/git/connect.c:426:8 #5 0x72f21a in get_remote_refs /home/ahunt/oss-fuzz/git/connect.c:525:8 #6 0x979ab7 in handshake /home/ahunt/oss-fuzz/git/transport.c:305:4 #7 0x97872d in get_refs_via_connect /home/ahunt/oss-fuzz/git/transport.c:339:9 #8 0x9774b5 in transport_get_remote_refs /home/ahunt/oss-fuzz/git/transport.c:1388:4 #9 0x51cf80 in cmd_clone /home/ahunt/oss-fuzz/git/builtin/clone.c:1271:9 #10 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #11 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #12 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #13 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #14 0x69c45e in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #15 0x7f6a459d5349 in __libc_start_main (/lib64/libc.so.6+0x24349) Direct leak of 105 byte(s) in 1 object(s) allocated from: #0 0x49a859 in realloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 #1 0x9a71f6 in xrealloc /home/ahunt/oss-fuzz/git/wrapper.c:126:8 #2 0x93622d in strbuf_grow /home/ahunt/oss-fuzz/git/strbuf.c:98:2 #3 0x937a73 in strbuf_addch /home/ahunt/oss-fuzz/git/./strbuf.h:231:3 #4 0x939fcd in strbuf_add_absolute_path /home/ahunt/oss-fuzz/git/strbuf.c:911:4 #5 0x69d3ce in absolute_pathdup /home/ahunt/oss-fuzz/git/abspath.c:261:2 #6 0x51c688 in cmd_clone /home/ahunt/oss-fuzz/git/builtin/clone.c:1021:10 #7 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #8 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #9 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #10 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #11 0x69c45e in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #12 0x7f6a459d5349 in __libc_start_main (/lib64/libc.so.6+0x24349) Signed-off-by: Andrzej Hunt --- builtin/clone.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/builtin/clone.c b/builtin/clone.c index 51e844a2de0a..952fe3d8fc88 100644 --- a/builtin/clone.c +++ b/builtin/clone.c @@ -964,10 +964,10 @@ int cmd_clone(int argc, const char **argv, const char *prefix) { int is_bundle = 0, is_local; const char *repo_name, *repo, *work_tree, *git_dir; - char *path, *dir, *display_repo = NULL; + char *path = NULL, *dir, *display_repo = NULL; int dest_exists, real_dest_exists = 0; const struct ref *refs, *remote_head; - const struct ref *remote_head_points_at; + struct ref *remote_head_points_at = NULL; const struct ref *our_head_points_at; struct ref *mapped_refs; const struct ref *ref; @@ -1017,9 +1017,10 @@ int cmd_clone(int argc, const char **argv, const char *prefix) repo_name = argv[0]; path = get_repo_path(repo_name, &is_bundle); - if (path) + if (path) { + FREE_AND_NULL(path); repo = absolute_pathdup(repo_name); - else if (strchr(repo_name, ':')) { + } else if (strchr(repo_name, ':')) { repo = repo_name; display_repo = transport_anonymize_url(repo); } else @@ -1393,6 +1394,11 @@ int cmd_clone(int argc, const char **argv, const char *prefix) strbuf_release(&reflog_msg); strbuf_release(&branch_top); strbuf_release(&key); + free_refs(mapped_refs); + free_refs(remote_head_points_at); + free(dir); + free(path); + UNLEAK(repo); junk_mode = JUNK_LEAVE_ALL; strvec_clear(&transport_ls_refs_options.ref_prefixes); From patchwork Sun Mar 14 18:47:37 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137903 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03CB8C4332B for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D71B264EB0 for ; Sun, 14 Mar 2021 18:48:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234119AbhCNSsW (ORCPT ); Sun, 14 Mar 2021 14:48:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52090 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233912AbhCNSrr (ORCPT ); Sun, 14 Mar 2021 14:47:47 -0400 Received: from mail-wm1-x331.google.com (mail-wm1-x331.google.com [IPv6:2a00:1450:4864:20::331]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DD430C061762 for ; Sun, 14 Mar 2021 11:47:46 -0700 (PDT) Received: by mail-wm1-x331.google.com with SMTP id g25so6841617wmh.0 for ; Sun, 14 Mar 2021 11:47:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=dsdlIfBIWjFjjQUFEJkLCxf+5hhOr4wPB3YEkStWjUU=; b=vIgDfkFPOz8Vd3yLBn3McFJ/FVnPLWbdTRvvSY2n9xwDJQFt8isvTUeCT8tTbT7MQ5 4Y3akydBH++SRnr3Lds922i6Ox6lArmL3rXy7sP8lht8Ne6c2mQ9yGQchmGUyydiNPTp /WbpB2xMgxUCWmckuxWpWte5A6eDLAbz0Ug0AHE5kfGeMsw9YdT/1YTHYVlfNRSAKuV5 0n5TEfpI5JbTGfWks38bYfO+9akvl5gMhgrw4TQt01DATdj5q9Xv7/V455q9suDeuU+g NYUuSTW6EFxD9HdXFRFocBa7xCp5S0/pUKYaWZ6tbkjuc4EZ9kCCr6RBLybRkI+98M4o A0Lg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=dsdlIfBIWjFjjQUFEJkLCxf+5hhOr4wPB3YEkStWjUU=; b=Q/VBbkDhcmk/Kh4t4UgYhWmsIZTEMnVCrbdNU8i00RWgffyvQ10d1j3dfXqkBTWoF/ Py6yiwsNNsxPdw1kxblojfVCdNC26drzJ5FqpYMgh/n60qLSboRa1a6rX89COsV63kDo 3kJiVYMmwxGbYtbjVsCeOxmoOsUYL8KEI+dtLv/ilOfTKeXlD3fyGFqpbMP/eytYch1A bFfMHSvrIpo5VA+w/mvLGXTL9Fmbz4FgmwdMvsxcR9SaMHzCEZlSqI6TnTPEeQxrOG2T H37V/mHlV+5b01JBe4Bq3vx2eh7zetnWzV2SJfNWwiYExZTSk+k9vjkohjKOHodMN9yQ MVHQ== X-Gm-Message-State: AOAM533yw7WI46SuoGT92BYZh35QoYayWUdRC1aqzSEIZsxDd1BPbzD+ sCj9tm9pZ9WxnoVX7drrC+TmjXZSZjg= X-Google-Smtp-Source: ABdhPJypClUErR7rw+o1XFMj7/wOKiU5uhHzpczPWgC+pTWUaMIiXCAz4KiVPfQO0WsRSJXglIqI0w== X-Received: by 2002:a1c:bc82:: with SMTP id m124mr22711540wmf.118.1615747665665; Sun, 14 Mar 2021 11:47:45 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id a13sm14122834wrp.31.2021.03.14.11.47.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:45 -0700 (PDT) Message-Id: In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:37 +0000 Subject: [PATCH v2 4/9] worktree: fix leak in dwim_branch() Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt Make sure that we release the temporary strbuf during dwim_branch() for all codepaths (and not just for the early return). This leak appears to have been introduced in: f60a7b763f (worktree: teach "add" to check out existing branches, 2018-04-24) Note that UNLEAK(branchname) is still needed: the returned result is used in add(), and is stored in a pointer which is used to point at one of: - a string literal ("HEAD") - member of argv (whatever the user specified in their invocation) - or our newly allocated string returned from dwim_branch() Fixing the branchname leak isn't impossible, but does not seem worthwhile given that add() is called directly from cmd_main(), and cmd_main() returns immediately thereafter - UNLEAK is good enough. This leak was found when running t0001 with LSAN, see also LSAN output below: Direct leak of 60 byte(s) in 1 object(s) allocated from: #0 0x49a859 in realloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 #1 0x9ab076 in xrealloc /home/ahunt/oss-fuzz/git/wrapper.c:126:8 #2 0x939fcd in strbuf_grow /home/ahunt/oss-fuzz/git/strbuf.c:98:2 #3 0x93af53 in strbuf_splice /home/ahunt/oss-fuzz/git/strbuf.c:239:3 #4 0x83559a in strbuf_check_branch_ref /home/ahunt/oss-fuzz/git/object-name.c:1593:2 #5 0x6988b9 in dwim_branch /home/ahunt/oss-fuzz/git/builtin/worktree.c:454:20 #6 0x695f8f in add /home/ahunt/oss-fuzz/git/builtin/worktree.c:525:19 #7 0x694a04 in cmd_worktree /home/ahunt/oss-fuzz/git/builtin/worktree.c:1036:10 #8 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #9 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #10 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #11 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #12 0x69caee in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #13 0x7f7b7dd10349 in __libc_start_main (/lib64/libc.so.6+0x24349) Signed-off-by: Andrzej Hunt --- builtin/worktree.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/builtin/worktree.c b/builtin/worktree.c index 1cd5c2016e3f..b0563aef685f 100644 --- a/builtin/worktree.c +++ b/builtin/worktree.c @@ -446,16 +446,18 @@ static void print_preparing_worktree_line(int detach, static const char *dwim_branch(const char *path, const char **new_branch) { int n; + int branch_exists; const char *s = worktree_basename(path, &n); const char *branchname = xstrndup(s, n); struct strbuf ref = STRBUF_INIT; UNLEAK(branchname); - if (!strbuf_check_branch_ref(&ref, branchname) && - ref_exists(ref.buf)) { - strbuf_release(&ref); + + branch_exists = !strbuf_check_branch_ref(&ref, branchname) && + ref_exists(ref.buf); + strbuf_release(&ref); + if (branch_exists) return branchname; - } *new_branch = branchname; if (guess_remote) { From patchwork Sun Mar 14 18:47:38 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137905 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A655C4332E for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C46CF64EC3 for ; Sun, 14 Mar 2021 18:48:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234105AbhCNSsV (ORCPT ); Sun, 14 Mar 2021 14:48:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233985AbhCNSrt (ORCPT ); Sun, 14 Mar 2021 14:47:49 -0400 Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BBFD1C061764 for ; Sun, 14 Mar 2021 11:47:47 -0700 (PDT) Received: by mail-wm1-x335.google.com with SMTP id f22-20020a7bc8d60000b029010c024a1407so18961124wml.2 for ; Sun, 14 Mar 2021 11:47:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=1KBF5N6/UdlX0Uvlr+J/y3JlDuq6Ng41G1ae0vnw04Y=; b=n+eyJmEndlANTYNbjmPPO2tn0m7GYc0vfBPKrDUjjuW/QOSfyaqDx59J1oc0bxswBM ALPVJWqGDfPjjN9GfEr+E8dNsIV36jF8GCSA6QHYYV48kD+gtAHhDr1HwXvHcmCwZLR0 pC/nGWXNqLocrFnZBxWONqyFc2An87V7a5vLNlbElcLiIBwgOx1d4oRJreQptUD/2oLT 7o2q96jQ5j9U3GVtBIdnYIi1+nPr0ZQvZL+iFmdwU0IyY6z4luyFExVONg4MOTW7cAGz qxSd6dfNe2+VtW33iFl50jUyLePBEmmdpjmDbSrUNSf240tpzGjAmAgMo/UOZnBKbfMW TwXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=1KBF5N6/UdlX0Uvlr+J/y3JlDuq6Ng41G1ae0vnw04Y=; b=TUFmWcLSM5A6jQUZbzF+4xswgQ3S6Gauepb174hkYv0gerEJX5k9VCGgWJUSDNCDa7 gulAXcjymQoi+WzSM3ooakXB4x4O+XmnG6ZaUGZXXfbHJ+qBFOhUEx7B2c7BbikPN4EQ GN4C7LPeP3EIaTh0R83qKOr+NX6i2OOVLqTUPNLEQn2mPzsPpnFp9DTF+SUUzPRBZVR8 1yqF+qQuY+RbM5Cm8a2L4KW/nvxyY2dNrQGLMm02C5aoGv5hKPRuVljLbbGSgSJUMun1 2lqxnh55MaW+iCKvW7MG4mQb+o2BB+WWXtwSn2IHAjr+pBYg/WRAmYtrceXxA4j9N2u8 LSeQ== X-Gm-Message-State: AOAM531KTnXrFR+npM0h1PQAXwN3SW8wEK0Aaiv3pABFz+C8d71yYa4f qEV+uPjyT1sNn22wSN69+3kjkDtC1Mc= X-Google-Smtp-Source: ABdhPJw7SYMTXY8SLePzpd1C0NFa+gRT3H9dqg9ZZiu7TVb1eZ0FxJjtQ5zwV8LlvhkpopMmhLZoAg== X-Received: by 2002:a1c:ba88:: with SMTP id k130mr22764948wmf.42.1615747666204; Sun, 14 Mar 2021 11:47:46 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id y18sm16460587wrw.39.2021.03.14.11.47.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:45 -0700 (PDT) Message-Id: <206a82200ca1d1da2232a98f9ec63ef7559fe97e.1615747662.git.gitgitgadget@gmail.com> In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:38 +0000 Subject: [PATCH v2 5/9] init: remove git_init_db_config() while fixing leaks Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt The primary goal of this change is to stop leaking init_db_template_dir. This leak can happen because: 1. git_init_db_config() allocates new memory into init_db_template_dir without first freeing the existing value. 2. init_db_template_dir might already contain data, either because: 2.1 git_config() can be invoked twice with this callback in a single process - at least 2 allocations are likely. 2.2 A single git_config() allocation can invoke the callback multiple times for a given key (see further explanation in the function docs) - each of those calls will trigger another leak. The simplest fix for the leak would be to free(init_db_template_dir) before overwriting it. Instead we choose to convert to fetching init.templatedir via git_config_get_value() as that is more explicit, more efficient, and avoids allocations (the returned result is owned by the config cache, so we aren't responsible for freeing it). If we remove init_db_template_dir, git_init_db_config() ends up being responsible only for forwarding core.* config values to platform_core_config(). However platform_core_config() already ignores non-core.* config values, so we can safely remove git_init_db_config() and invoke git_config() directly with platform_core_config() as the callback. The platform_core_config forwarding was originally added in: 287853392a (mingw: respect core.hidedotfiles = false in git-init again, 2019-03-11 And I suspect the potential for a leak existed since the original implementation of git_init_db_config in: 90b45187ba (Add `init.templatedir` configuration variable., 2010-02-17) LSAN output from t0001: Direct leak of 73 byte(s) in 1 object(s) allocated from: #0 0x49a859 in realloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3 #1 0x9a7276 in xrealloc /home/ahunt/oss-fuzz/git/wrapper.c:126:8 #2 0x9362ad in strbuf_grow /home/ahunt/oss-fuzz/git/strbuf.c:98:2 #3 0x936eaa in strbuf_add /home/ahunt/oss-fuzz/git/strbuf.c:295:2 #4 0x868112 in strbuf_addstr /home/ahunt/oss-fuzz/git/./strbuf.h:304:2 #5 0x86a8ad in expand_user_path /home/ahunt/oss-fuzz/git/path.c:758:2 #6 0x720bb1 in git_config_pathname /home/ahunt/oss-fuzz/git/config.c:1287:10 #7 0x5960e2 in git_init_db_config /home/ahunt/oss-fuzz/git/builtin/init-db.c:161:11 #8 0x7255b8 in configset_iter /home/ahunt/oss-fuzz/git/config.c:1982:7 #9 0x7253fc in repo_config /home/ahunt/oss-fuzz/git/config.c:2311:2 #10 0x725ca7 in git_config /home/ahunt/oss-fuzz/git/config.c:2399:2 #11 0x593e8d in create_default_files /home/ahunt/oss-fuzz/git/builtin/init-db.c:225:2 #12 0x5935c6 in init_db /home/ahunt/oss-fuzz/git/builtin/init-db.c:449:11 #13 0x59588e in cmd_init_db /home/ahunt/oss-fuzz/git/builtin/init-db.c:714:9 #14 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #15 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #16 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #17 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #18 0x69c4de in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #19 0x7f23552d6349 in __libc_start_main (/lib64/libc.so.6+0x24349) Signed-off-by: Andrzej Hunt --- builtin/init-db.c | 28 +++++++--------------------- 1 file changed, 7 insertions(+), 21 deletions(-) diff --git a/builtin/init-db.c b/builtin/init-db.c index dcc45bef5148..d31dbc883746 100644 --- a/builtin/init-db.c +++ b/builtin/init-db.c @@ -25,7 +25,6 @@ static int init_is_bare_repository = 0; static int init_shared_repository = -1; -static const char *init_db_template_dir; static void copy_templates_1(struct strbuf *path, struct strbuf *template_path, DIR *dir) @@ -94,7 +93,7 @@ static void copy_templates_1(struct strbuf *path, struct strbuf *template_path, } } -static void copy_templates(const char *template_dir) +static void copy_templates(const char *template_dir, const char *init_template_dir) { struct strbuf path = STRBUF_INIT; struct strbuf template_path = STRBUF_INIT; @@ -107,7 +106,7 @@ static void copy_templates(const char *template_dir) if (!template_dir) template_dir = getenv(TEMPLATE_DIR_ENVIRONMENT); if (!template_dir) - template_dir = init_db_template_dir; + template_dir = init_template_dir; if (!template_dir) template_dir = to_free = system_path(DEFAULT_GIT_TEMPLATE_DIR); if (!template_dir[0]) { @@ -154,17 +153,6 @@ static void copy_templates(const char *template_dir) clear_repository_format(&template_format); } -static int git_init_db_config(const char *k, const char *v, void *cb) -{ - if (!strcmp(k, "init.templatedir")) - return git_config_pathname(&init_db_template_dir, k, v); - - if (starts_with(k, "core.")) - return platform_core_config(k, v, cb); - - return 0; -} - /* * If the git_dir is not directly inside the working tree, then git will not * find it by default, and we need to set the worktree explicitly. @@ -212,10 +200,7 @@ static int create_default_files(const char *template_path, int reinit; int filemode; struct strbuf err = STRBUF_INIT; - - /* Just look for `init.templatedir` */ - init_db_template_dir = NULL; /* re-set in case it was set before */ - git_config(git_init_db_config, NULL); + const char *init_template_dir = NULL; /* * First copy the templates -- we might have the default @@ -226,7 +211,8 @@ static int create_default_files(const char *template_path, * values (since we've just potentially changed what's available on * disk). */ - copy_templates(template_path); + git_config_get_value("init.templatedir", &init_template_dir); + copy_templates(template_path, init_template_dir); git_config_clear(); reset_shared_repository(); git_config(git_default_config, NULL); @@ -422,8 +408,8 @@ int init_db(const char *git_dir, const char *real_git_dir, } startup_info->have_repository = 1; - /* Just look for `core.hidedotfiles` */ - git_config(git_init_db_config, NULL); + /* Ensure `core.hidedotfiles` is processed */ + git_config(platform_core_config, NULL); safe_create_dir(git_dir, 0); From patchwork Sun Mar 14 18:47:39 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137913 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 544B6C43333 for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 389D164EB0 for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234204AbhCNSs0 (ORCPT ); Sun, 14 Mar 2021 14:48:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52098 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234014AbhCNSrt (ORCPT ); Sun, 14 Mar 2021 14:47:49 -0400 Received: from mail-wm1-x329.google.com (mail-wm1-x329.google.com [IPv6:2a00:1450:4864:20::329]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E1253C061574 for ; Sun, 14 Mar 2021 11:47:48 -0700 (PDT) Received: by mail-wm1-x329.google.com with SMTP id f22-20020a7bc8d60000b029010c024a1407so18961130wml.2 for ; Sun, 14 Mar 2021 11:47:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=GagUwiP0HL+zZ0S6XbUDvsJLMDayoR/u1iElHCEGZxE=; b=qPeeo321Z2SuMsm/y/Qj/cSy0qS+tJCxoVaECOGiPt2edxj47xU+hMKjrtLB4sVRHy aMXSdrKtxyHrPxMYiZRXiFkXEI0Xzb90jeHmzuML0XRlY41zgG7R3FWllmA0A/YNJL6o ETq99zQK4+Y3rB492w4cCtEr7jQm9Ju0xWgqqXy0jiLypankmvS9g11TA/yJYyHCvNH1 RjU21HK65CHucwgFAnDyNZGn46YA8spjNYCueBFwh/SBHAoXmMWv/pfpE54OCN2ATVEA hbcQI+r7WF38/ROV19UXRx38BhSHgo++eruf8M2K67yCFNU2+n0qt0fIXGZg4pR51nh0 2VIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=GagUwiP0HL+zZ0S6XbUDvsJLMDayoR/u1iElHCEGZxE=; b=aGKWXmmgXnxIro/AcfCVgq99DY5EDHzuKEP3JxayRw3m9oG0ARksbIbbJsqyLb9Loa BkE1Pyx9em8NHnPDD05MunSQi5uSh4/FoOO/NNsJ+F5CVFZlF2tjsC+dqB0cktuLDU2G JqdsbQ0/JSAJ/aYHX4rj+KZ4VOUIO9W6Gh4JhP64OjlKjCTpUHb4XkcJbhvUBdKIHG8v d/dC3XB096HSBfOGfpgB7QxUuHlucjjlq/6o/IWCF/ZT3xx/wprj+JdVxXij8hklRAn7 4XekkmJThtyu/g3EZuz5nqg7KoXXI0Xf+/iH+IuKFXFV32YkK0mRDIRMaizwhgMmejiC LLeA== X-Gm-Message-State: AOAM531FQpG4csa1/teZ9PLLeSQokIj3bIQjfsgf6agVcUlVzob3xBKf 3PPMpb0zFsJS3N3v6leO+3QHtlsgTJQ= X-Google-Smtp-Source: ABdhPJwKp8fiYU8oB/0+QqbvZpgYGXHNMRwKdUCDkZkQOSvTMZxEkaXoNSx74IULWk27yliLvFpAWg== X-Received: by 2002:a1c:6745:: with SMTP id b66mr23123919wmc.114.1615747666749; Sun, 14 Mar 2021 11:47:46 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id a17sm10109641wmj.9.2021.03.14.11.47.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:46 -0700 (PDT) Message-Id: In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:39 +0000 Subject: [PATCH v2 6/9] init-db: silence template_dir leak when converting to absolute path Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt template_dir starts off pointing to either argv or nothing. However if the value supplied in argv is a relative path, absolute_pathdup() is used to turn it into an absolute path. absolute_pathdup() allocates a new string, and we then "leak" it when cmd_init_db() completes. We don't bother to actually free the return value (instead we UNLEAK it), because there's no significant advantage to doing so here. Correctly freeing it would require more significant changes to code flow which would be more noisy than beneficial. Signed-off-by: Andrzej Hunt --- builtin/init-db.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/builtin/init-db.c b/builtin/init-db.c index d31dbc883746..efc66523e22c 100644 --- a/builtin/init-db.c +++ b/builtin/init-db.c @@ -561,8 +561,10 @@ int cmd_init_db(int argc, const char **argv, const char *prefix) if (real_git_dir && !is_absolute_path(real_git_dir)) real_git_dir = real_pathdup(real_git_dir, 1); - if (template_dir && *template_dir && !is_absolute_path(template_dir)) + if (template_dir && *template_dir && !is_absolute_path(template_dir)) { template_dir = absolute_pathdup(template_dir); + UNLEAK(template_dir); + } if (argc == 1) { int mkdir_tried = 0; From patchwork Sun Mar 14 18:47:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137901 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D69AFC4332D for ; Sun, 14 Mar 2021 18:48:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ABA7664EB7 for ; Sun, 14 Mar 2021 18:48:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234085AbhCNSsU (ORCPT ); Sun, 14 Mar 2021 14:48:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233995AbhCNSrt (ORCPT ); Sun, 14 Mar 2021 14:47:49 -0400 Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 75177C061765 for ; Sun, 14 Mar 2021 11:47:48 -0700 (PDT) Received: by mail-wm1-x335.google.com with SMTP id 12so1834761wmf.5 for ; Sun, 14 Mar 2021 11:47:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=ZvTWExSIs1Egi3lbG0ImgK5994pq9tE5fF5dSYpfllM=; b=TJVZLyQhrjgHY5NB1XuagRl0LExE7UeJ7EnqacbPLtS/vHpqFAFx4Umuw3MZN/Jskg TfEXZjRRUO3BKIP0WtGuakC5rsmK6d9UnM5hFkROGRWdH5pPtazuvvrcgAYzLIqNcVMu CxZP8KWVFjUlsWcFOYqzMwsC7NUnSBCRdgOkZwyLlGUysIps3stnLNkYq+pg8BU25Z0Y bzRnmRcS3GoOxH/tD6w4GrcO49AoISSx7SvyWwDPgTjBaDc+pW2+lOE+xoCv2M2/vVkF GYJJ5IVXecG7WCZoYGslqKU0D3vZvcq0hbZgaSJ9+wfIq3Hu3b5sVbHPIhDcVhvvNEMn 8SRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=ZvTWExSIs1Egi3lbG0ImgK5994pq9tE5fF5dSYpfllM=; b=B2FlXH3pag2I5C1vaN884w4dRCINNvZIzRqqSz7ytGETACN5zeTZ3shnT4oCXbNDhp YQkR4zUZi3fYkToxc949KW+neWN2VLwmeLkKq+2/4+CIGbTiOens7BYWSboWPbI5RY03 XCYQaGBJf7v245GQME/saIrIl4YdhdncxitlKa34+I8HHtYlxSuL6NDm3usoHHn6odDN ApTK5opa8r0CAlwwlifTl2UvRj0duZWpmXk7exG6eCMGiMN5i3yTa5YhP1ULnJzgXFdR 60nmMY8c9KXP53ru6N2P4XPYSn3hMQkBJHJDMiSaWml637s+UBfQ6T5G/Y0SGW/Vhu34 lV6Q== X-Gm-Message-State: AOAM533NMxiiEpSaYvgUxrqlXK/qsB/mvLQBJIbs9J+vxftE6igPJsa/ pkkfFNchxtJ1wol863GoPpBdlorFCLY= X-Google-Smtp-Source: ABdhPJxNnjG0489Dr1SX5GFzmYvy1D8u44/wVmMUIIhkwfX+0cqvJrbiJ4P/dTSrKDgW/fM+BY/m4Q== X-Received: by 2002:a05:600c:4305:: with SMTP id p5mr22444373wme.58.1615747667220; Sun, 14 Mar 2021 11:47:47 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id r2sm15708264wrt.8.2021.03.14.11.47.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:46 -0700 (PDT) Message-Id: <2b03785bd4cb76285989aff259af57890ea9fe08.1615747662.git.gitgitgadget@gmail.com> In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:40 +0000 Subject: [PATCH v2 7/9] parse-options: convert bitfield values to use binary shift Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt Because it's easier to read, but also likely to be easier to maintain. I am making this change because I need to add a new flag in a later commit. Also add a trailing comma to the last enum entry to simplify addition of new flags. This changee was originally suggested by Peff in: https://public-inbox.org/git/YEZ%2FBWWbpfVwl6nO@coredump.intra.peff.net/ Signed-off-by: Andrzej Hunt --- parse-options.h | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/parse-options.h b/parse-options.h index ff6506a50470..36ce0a44b2e9 100644 --- a/parse-options.h +++ b/parse-options.h @@ -28,26 +28,26 @@ enum parse_opt_type { }; enum parse_opt_flags { - PARSE_OPT_KEEP_DASHDASH = 1, - PARSE_OPT_STOP_AT_NON_OPTION = 2, - PARSE_OPT_KEEP_ARGV0 = 4, - PARSE_OPT_KEEP_UNKNOWN = 8, - PARSE_OPT_NO_INTERNAL_HELP = 16, - PARSE_OPT_ONE_SHOT = 32 + PARSE_OPT_KEEP_DASHDASH = 1 << 0, + PARSE_OPT_STOP_AT_NON_OPTION = 1 << 1, + PARSE_OPT_KEEP_ARGV0 = 1 << 2, + PARSE_OPT_KEEP_UNKNOWN = 1 << 3, + PARSE_OPT_NO_INTERNAL_HELP = 1 << 4, + PARSE_OPT_ONE_SHOT = 1 << 5, }; enum parse_opt_option_flags { - PARSE_OPT_OPTARG = 1, - PARSE_OPT_NOARG = 2, - PARSE_OPT_NONEG = 4, - PARSE_OPT_HIDDEN = 8, - PARSE_OPT_LASTARG_DEFAULT = 16, - PARSE_OPT_NODASH = 32, - PARSE_OPT_LITERAL_ARGHELP = 64, - PARSE_OPT_SHELL_EVAL = 256, - PARSE_OPT_NOCOMPLETE = 512, - PARSE_OPT_COMP_ARG = 1024, - PARSE_OPT_CMDMODE = 2048 + PARSE_OPT_OPTARG = 1 << 0, + PARSE_OPT_NOARG = 1 << 1, + PARSE_OPT_NONEG = 1 << 2, + PARSE_OPT_HIDDEN = 1 << 3, + PARSE_OPT_LASTARG_DEFAULT = 1 << 4, + PARSE_OPT_NODASH = 1 << 5, + PARSE_OPT_LITERAL_ARGHELP = 1 << 6, + PARSE_OPT_SHELL_EVAL = 1 << 7, + PARSE_OPT_NOCOMPLETE = 1 << 8, + PARSE_OPT_COMP_ARG = 1 << 9, + PARSE_OPT_CMDMODE = 1 << 10, }; enum parse_opt_result { From patchwork Sun Mar 14 18:47:42 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrzej Hunt X-Patchwork-Id: 12137911 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49B33C432C3 for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2319364EB3 for ; Sun, 14 Mar 2021 18:48:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234219AbhCNSs1 (ORCPT ); Sun, 14 Mar 2021 14:48:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234015AbhCNSru (ORCPT ); Sun, 14 Mar 2021 14:47:50 -0400 Received: from mail-wm1-x331.google.com (mail-wm1-x331.google.com [IPv6:2a00:1450:4864:20::331]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C702C061762 for ; Sun, 14 Mar 2021 11:47:49 -0700 (PDT) Received: by mail-wm1-x331.google.com with SMTP id c76-20020a1c9a4f0000b029010c94499aedso18952003wme.0 for ; Sun, 14 Mar 2021 11:47:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:in-reply-to:references:from:date:subject:fcc :content-transfer-encoding:mime-version:to:cc; bh=ANLefIfNT6KqxHw34lbYaw6i8B+a8Qc8myrPM3OnlpI=; b=YHbH7OXYhX4WqIbrRzRLHdLhphhYfj7zHaqDCaLo2UxQXNo/M1M9SDl/fX1rMChR4I DNyTaecJrpg6W6Occ8I0a8058M49pH1iZyds8pQrFAANjVBF0h1uiBIGnws6L3IO+UnQ U+pxpEa8gqSZI7miJ1KnoDFL1V7w+QQ1DOuk6O+XgpfDR8zaI15NMwsJoKRk9O7drMZk xmnmJ367IvXWm8XDYhpW0nt8JYJJcUnSJk3I3sRktn1JVyMUGOL3IfjkCfitWLltds37 3z/cqHd1D+2BWMy2mGap9Faj9ojtQYgQyfjiOtSTAELXWOSffx7VPlB/IIpYUsQDmdZu dItQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:in-reply-to:references:from:date :subject:fcc:content-transfer-encoding:mime-version:to:cc; bh=ANLefIfNT6KqxHw34lbYaw6i8B+a8Qc8myrPM3OnlpI=; b=pdnaVWMFfuCm8dWcMXNR9RHHTaKVAYBbQIPLP9I0oH5p0m/aYuTuA6OlahU7429uPb 9jlc4aP/fqNC/NOfloZyBq6jXPjxCBAvSqBT2QlmjhzRwTrvfOafMCAu9cnKqPGxrx3H NZu8kFgWDat6LeTbqjGwyFI73mMvayx8bMCmh472NoqHIZxW7A8+D0WsVYbXKq2bynDg sJ+z6AtlQldcBuLMkDlTWfLZdV+GFQCZqemkReFl/aXwlomd8sMZtAZuVHudEPUIgusy YOw82MHm+ebZU3WBDmiUFZL4plQBgZsqgeKQ6jE2uwSBbK+uSf62kfmD5qBO+wCCpf98 s4vw== X-Gm-Message-State: AOAM530mTEk2hEHAAJ/k5I2ryhGIfLDqS1Ej4wsAzp8FIMGyplpxK2e9 2wbBRer8k7X1PkIPeFMFrGT8PzG466Q= X-Google-Smtp-Source: ABdhPJxQZh8fyOMN1XznYmHADTtx7vic1qRSWjrPjvvNVW1e8hPAeHOloDp2XrxJrV36MN0++E5Ymg== X-Received: by 2002:a05:600c:4f44:: with SMTP id m4mr22435360wmq.175.1615747668322; Sun, 14 Mar 2021 11:47:48 -0700 (PDT) Received: from [127.0.0.1] ([13.74.141.28]) by smtp.gmail.com with ESMTPSA id s3sm9573632wmd.21.2021.03.14.11.47.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 14 Mar 2021 11:47:48 -0700 (PDT) Message-Id: In-Reply-To: References: Date: Sun, 14 Mar 2021 18:47:42 +0000 Subject: [PATCH v2 9/9] transport: also free remote_refs in transport_disconnect() Fcc: Sent MIME-Version: 1.0 To: git@vger.kernel.org Cc: Andrzej Hunt , Andrzej Hunt Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org From: Andrzej Hunt From: Andrzej Hunt transport_get_remote_refs() can populate the transport struct's remote_refs. transport_disconnect() is already responsible for most of transport's cleanup - therefore we also take care of freeing remote_refs there. There are 2 locations where transport_disconnect() is called before we're done using the returned remote_refs. This patch changes those callsites to only call transport_disconnect() after the returned refs are no longer being used - which is necessary to safely be able to free remote_refs during transport_disconnect(). This commit fixes the following leak which was found while running t0000, but is expected to also fix the same pattern of leak in all locations that use transport_get_remote_refs(): Direct leak of 165 byte(s) in 1 object(s) allocated from: #0 0x49a6b2 in calloc /home/abuild/rpmbuild/BUILD/llvm-11.0.0.src/build/../projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3 #1 0x9a72f2 in xcalloc /home/ahunt/oss-fuzz/git/wrapper.c:140:8 #2 0x8ce203 in alloc_ref_with_prefix /home/ahunt/oss-fuzz/git/remote.c:867:20 #3 0x8ce1a2 in alloc_ref /home/ahunt/oss-fuzz/git/remote.c:875:9 #4 0x72f63e in process_ref_v2 /home/ahunt/oss-fuzz/git/connect.c:426:8 #5 0x72f21a in get_remote_refs /home/ahunt/oss-fuzz/git/connect.c:525:8 #6 0x979ab7 in handshake /home/ahunt/oss-fuzz/git/transport.c:305:4 #7 0x97872d in get_refs_via_connect /home/ahunt/oss-fuzz/git/transport.c:339:9 #8 0x9774b5 in transport_get_remote_refs /home/ahunt/oss-fuzz/git/transport.c:1388:4 #9 0x51cf80 in cmd_clone /home/ahunt/oss-fuzz/git/builtin/clone.c:1271:9 #10 0x4cd60d in run_builtin /home/ahunt/oss-fuzz/git/git.c:453:11 #11 0x4cb2da in handle_builtin /home/ahunt/oss-fuzz/git/git.c:704:3 #12 0x4ccc37 in run_argv /home/ahunt/oss-fuzz/git/git.c:771:4 #13 0x4cac29 in cmd_main /home/ahunt/oss-fuzz/git/git.c:902:19 #14 0x69c45e in main /home/ahunt/oss-fuzz/git/common-main.c:52:11 #15 0x7f6a459d5349 in __libc_start_main (/lib64/libc.so.6+0x24349) Signed-off-by: Andrzej Hunt --- builtin/ls-remote.c | 4 ++-- builtin/remote.c | 8 ++++---- transport.c | 2 ++ 3 files changed, 8 insertions(+), 6 deletions(-) diff --git a/builtin/ls-remote.c b/builtin/ls-remote.c index ef604752a044..5432d239a681 100644 --- a/builtin/ls-remote.c +++ b/builtin/ls-remote.c @@ -124,8 +124,6 @@ int cmd_ls_remote(int argc, const char **argv, const char *prefix) int hash_algo = hash_algo_by_ptr(transport_get_hash_algo(transport)); repo_set_hash_algo(the_repository, hash_algo); } - if (transport_disconnect(transport)) - return 1; if (!dest && !quiet) fprintf(stderr, "From %s\n", *remote->url); @@ -151,5 +149,7 @@ int cmd_ls_remote(int argc, const char **argv, const char *prefix) } ref_array_clear(&ref_array); + if (transport_disconnect(transport)) + return 1; return status; } diff --git a/builtin/remote.c b/builtin/remote.c index d11a5589e49d..e31d9c99470e 100644 --- a/builtin/remote.c +++ b/builtin/remote.c @@ -938,9 +938,6 @@ static int get_remote_ref_states(const char *name, struct ref_states *states, int query) { - struct transport *transport; - const struct ref *remote_refs; - states->remote = remote_get(name); if (!states->remote) return error(_("No such remote: '%s'"), name); @@ -948,10 +945,12 @@ static int get_remote_ref_states(const char *name, read_branches(); if (query) { + struct transport *transport; + const struct ref *remote_refs; + transport = transport_get(states->remote, states->remote->url_nr > 0 ? states->remote->url[0] : NULL); remote_refs = transport_get_remote_refs(transport, NULL); - transport_disconnect(transport); states->queried = 1; if (query & GET_REF_STATES) @@ -960,6 +959,7 @@ static int get_remote_ref_states(const char *name, get_head_names(remote_refs, states); if (query & GET_PUSH_REF_STATES) get_push_ref_states(remote_refs, states); + transport_disconnect(transport); } else { for_each_ref(append_ref_to_tracked_list, states); string_list_sort(&states->tracked); diff --git a/transport.c b/transport.c index b13fab5dc3b1..62362d79dd87 100644 --- a/transport.c +++ b/transport.c @@ -1452,6 +1452,8 @@ int transport_disconnect(struct transport *transport) int ret = 0; if (transport->vtable->disconnect) ret = transport->vtable->disconnect(transport); + if (transport->got_remote_refs) + free_refs((void *)transport->remote_refs); free(transport); return ret; }