Null pointer dereference in git-submodule

[Jeremy Feusi <jeremy@feusi.co>]

[-- Attachment #1: Type: text/plain, Size: 2485 bytes --]

Hi,
While bootstrapping a gnu repository I noticed that git segfaulted when
called as "git submodule status". After compiling git with address
sanitizer and minimizing the directory I finally narrowed it down to the
files which I have attached as a tar archive. Here is a detailed backtrace:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==63400==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000c27a93 bp 0x7ffdcb4eec10 sp 0x7ffdcb4eeb80 T0)
==63400==The signal is caused by a READ memory access.
==63400==Hint: address points to the zero page.
    #0 0xc27a92 in refs_read_raw_ref /home/jfe/git/refs.c:1451:20
    #1 0xc174a6 in refs_resolve_ref_unsafe /home/jfe/git/refs.c:1493:7
    #2 0xc1826a in refs_read_ref_full /home/jfe/git/refs.c:224:6
    #3 0xc26d53 in refs_head_ref /home/jfe/git/refs.c:1314:7
    #4 0x8071e6 in status_submodule /home/jfe/git/builtin/submodule--helper.c:658:7
    #5 0x806a89 in status_submodule_cb /home/jfe/git/builtin/submodule--helper.c:699:2
    #6 0x80523e in for_each_listed_submodule /home/jfe/git/builtin/submodule--helper.c:438:3
    #7 0x7f7e9a in module_status /home/jfe/git/builtin/submodule--helper.c:732:2
    #8 0x7efd69 in cmd_submodule__helper /home/jfe/git/builtin/submodule--helper.c:1859:11
    #9 0x51e024 in run_builtin /home/jfe/git/git.c:346:11
    #10 0x5192c2 in handle_builtin /home/jfe/git/git.c:554:8
    #11 0x51d0f0 in run_argv /home/jfe/git/git.c:606:4
    #12 0x518600 in cmd_main /home/jfe/git/git.c:683:19
    #13 0x8501d6 in main /home/jfe/git/common-main.c:43:9
    #14 0x7f49fdaf2f29 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20f29)
    #15 0x41f4b9 in _start (/home/jfe/git/inst/libexec/git-core/git+0x41f4b9)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/jfe/git/refs.c:1451:20 in refs_read_raw_ref
==63400==ABORTING

As mentioned above, this bug is triggered by issuing the command
"git submodule status" while in the attached directory.

This bug was confirmed on Debian with version 2.16.1 and
2.17.0.rc1.35.g90bbd502d as well as on Arch Linux with version 2.16.2
where further output is given by git:

/usr/lib/git-core/git-submodule: line 979:  8119 Segmentation fault      (core dumped) git ${wt_prefix:+-C "$wt_prefix"} ${prefix:+--super-prefix "$prefix"} submodule--helper status ${GIT_QUIET:+--quiet} ${cached:+--cached} ${recursive:+--recursive} "$@"

cheers
Jeremy

[-- Attachment #2: min-man.tar.gz --]
[-- Type: application/gzip, Size: 42292 bytes --]