From: Elijah Newren <newren@gmail.com>
To: git@vger.kernel.org
Cc: peff@peff.net, gitster@pobox.com, B.Steinbrink@gmx.de,
sbejar@gmail.com, Elijah Newren <newren@gmail.com>
Subject: [PATCH v2] rev-parse: check lookup'ed commit references for NULL
Date: Wed, 23 May 2018 23:27:33 -0700 [thread overview]
Message-ID: <20180524062733.5412-1-newren@gmail.com> (raw)
In-Reply-To: <20180523220915.GB32171@sigill.intra.peff.net>
Commits 2122f8b963d4 ("rev-parse: Add support for the ^! and ^@ syntax",
2008-07-26) and 3dd4e7320d ("Teach rev-parse the ... syntax.", 2006-07-04)
taught rev-parse new syntax, and used lookup_commit_reference() as part of
their logic. Neither usage checked the returned commit to see if it was
non-NULL before using it. Check for NULL and ensure an appropriate error
is reported to the user.
Reported by Florian Weimer and Todd Zullinger.
Helped-by: Jeff King <peff@peff.net>
Signed-off-by: Elijah Newren <newren@gmail.com>
---
I would have used a Reported-by tag for Florian and Todd, but looking at
the bugzilla.redhat.com bug report doesn't show me Florian's email
address. I grepped through git logs and found two associated with that
name, but didn't know if they were still accurate, or were a different
Florian. So I just went with the sentence instead.
builtin/rev-parse.c | 8 ++++++--
t/t6101-rev-parse-parents.sh | 8 ++++++++
2 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/builtin/rev-parse.c b/builtin/rev-parse.c
index a1e680b5e9..a0a0ace38d 100644
--- a/builtin/rev-parse.c
+++ b/builtin/rev-parse.c
@@ -282,6 +282,10 @@ static int try_difference(const char *arg)
struct commit *a, *b;
a = lookup_commit_reference(&start_oid);
b = lookup_commit_reference(&end_oid);
+ if (!a || !b) {
+ *dotdot = '.';
+ return 0;
+ }
exclude = get_merge_bases(a, b);
while (exclude) {
struct commit *commit = pop_commit(&exclude);
@@ -328,12 +332,12 @@ static int try_parent_shorthands(const char *arg)
return 0;
*dotdot = 0;
- if (get_oid_committish(arg, &oid)) {
+ if (get_oid_committish(arg, &oid) ||
+ !(commit = lookup_commit_reference(&oid))) {
*dotdot = '^';
return 0;
}
- commit = lookup_commit_reference(&oid);
if (exclude_parent &&
exclude_parent > commit_list_count(commit->parents)) {
*dotdot = '^';
diff --git a/t/t6101-rev-parse-parents.sh b/t/t6101-rev-parse-parents.sh
index 8c617981a3..7683e4a114 100755
--- a/t/t6101-rev-parse-parents.sh
+++ b/t/t6101-rev-parse-parents.sh
@@ -214,4 +214,12 @@ test_expect_success 'rev-list merge^-1x (garbage after ^-1)' '
test_must_fail git rev-list merge^-1x
'
+test_expect_success 'rev-parse $garbage^@ does not segfault' '
+ test_must_fail git rev-parse $EMPTY_TREE^@
+'
+
+test_expect_success 'rev-parse $garbage...$garbage does not segfault' '
+ test_must_fail git rev-parse $EMPTY_TREE...$EMPTY_BLOB
+'
+
test_done
--
2.17.0.1.gda85003413
next prev parent reply other threads:[~2018-05-24 6:27 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-05-23 19:52 BUG: rev-parse segfault with invalid input Todd Zullinger
2018-05-23 20:23 ` Elijah Newren
2018-05-23 20:45 ` Todd Zullinger
2018-05-23 20:46 ` [PATCH 1/2] t6101: add a test for rev-parse $garbage^@ Elijah Newren
2018-05-23 20:46 ` [PATCH 2/2] rev-parse: verify that commit looked up is not NULL Elijah Newren
2018-05-23 22:09 ` Jeff King
2018-05-24 6:27 ` Elijah Newren [this message]
2018-05-24 14:04 ` [PATCH v2] rev-parse: check lookup'ed commit references for NULL Todd Zullinger
2018-05-24 15:11 ` Florian Weimer
2018-05-24 17:06 ` Jeff King
2018-05-25 1:07 ` Junio C Hamano
2018-05-23 22:19 ` [PATCH 2/2] rev-parse: verify that commit looked up is not NULL Todd Zullinger
2018-05-23 22:23 ` Todd Zullinger
2018-05-23 22:12 ` [PATCH 1/2] t6101: add a test for rev-parse $garbage^@ Jeff King
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: http://vger.kernel.org/majordomo-info.html
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180524062733.5412-1-newren@gmail.com \
--to=newren@gmail.com \
--cc=B.Steinbrink@gmx.de \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=peff@peff.net \
--cc=sbejar@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://80x24.org/mirrors/git.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).