From: David Turner <dturner@twopensource.com>
To: Junio C Hamano <gitster@pobox.com>
Cc: git@vger.kernel.org, Keith McGuigan <kmcguigan@twitter.com>
Subject: Re: [PATCH v2] merge: fix cache_entry use-after-free
Date: Tue, 13 Oct 2015 15:22:47 -0400 [thread overview]
Message-ID: <1444764167.7234.14.camel@twopensource.com> (raw)
In-Reply-To: <xmqqio6bbu2w.fsf@gitster.mtv.corp.google.com>
On Mon, 2015-10-12 at 15:28 -0700, Junio C Hamano wrote:
> David Turner <dturner@twopensource.com> writes:
>
> > From: Keith McGuigan <kmcguigan@twitter.com>
> >
> > During merges, we would previously free entries that we no longer need
> > in the destination index. But those entries might also be stored in
> > the dir_entry cache, and when a later call to add_to_index found them,
> > they would be used after being freed.
> >
> > To prevent this, add a ref count for struct cache_entry. Whenever
> > a cache entry is added to a data structure, the ref count is incremented;
> > when it is removed from the data structure, it is decremented. When
> > it hits zero, the cache_entry is freed.
> >
> > Signed-off-by: Keith McGuigan <kmcguigan@twitter.com>
> > ---
>
> I'll forge your "messenger's sign-off" here ;-)
Thanks.
> > diff --git a/unpack-trees.c b/unpack-trees.c
> > index f932e80..1a0a637 100644
> > --- a/unpack-trees.c
> > +++ b/unpack-trees.c
> > @@ -606,8 +606,10 @@ static int unpack_nondirectories(int n, unsigned long mask,
> > o);
> > for (i = 0; i < n; i++) {
> > struct cache_entry *ce = src[i + o->merge];
> > - if (ce != o->df_conflict_entry)
> > - free(ce);
> > + if (ce != o->df_conflict_entry) {
> > + drop_ce_ref(ce);
> > + src[i + o->merge] = NULL;
> > + }
>
> This one smelled iffy. I think it is safe because the caller does
> not look at src[] other than src[0] after this function returns, and
> this setting to NULL happens only when o->merge is set to 1, so I do
> not think this is buggy, but at the same time I do not think setting
> to NULL is necessary.
>
> Other than that, looks nice. Thanks.
I like to set a pointer to NULL after I free the thing pointed to by it,
because it helps make use-after-free bugs easier to detect.
next prev parent reply other threads:[~2015-10-13 19:22 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-12 22:03 [PATCH v2] merge: fix cache_entry use-after-free David Turner
2015-10-12 22:28 ` Junio C Hamano
2015-10-13 19:22 ` David Turner [this message]
2015-10-13 21:05 ` Junio C Hamano
2015-10-14 21:17 ` Junio C Hamano
2015-10-14 22:00 ` David Turner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1444764167.7234.14.camel@twopensource.com \
--to=dturner@twopensource.com \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=kmcguigan@twitter.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).