[PATCH 0/1] pathspec: fix memleak

[PATCH 0/1] pathspec: fix memleak

[Anthony Delannoy]

Sending this patch to fix a memleak, created with copy_pathspec, found
thanks to the address sanitizer.

Thanks

Anthony Delannoy (1):
  pathspec: fix memleak

 preload-index.c | 3 +++
 1 file changed, 3 insertions(+)


base-commit: 5502f77b6944eda8e26813d8f542cffe7d110aea
--
2.35.1

[PATCH 1/1] pathspec: fix memleak

[Anthony Delannoy]

Fix a memory leak occuring in case of pathspec copy in preload_index.

Direct leak of 8 byte(s) in 8 object(s) allocated from:
    #0 0x7f0a353ead47 in __interceptor_malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/11.3.0/libasan.so.6+0xb5d47)
    #1 0x55750995e840 in do_xmalloc /home/anthony/src/c/git/wrapper.c:51
    #2 0x55750995e840 in xmalloc /home/anthony/src/c/git/wrapper.c:72
    #3 0x55750970f824 in copy_pathspec /home/anthony/src/c/git/pathspec.c:684
    #4 0x557509717278 in preload_index /home/anthony/src/c/git/preload-index.c:135
    #5 0x55750975f21e in refresh_index /home/anthony/src/c/git/read-cache.c:1633
    #6 0x55750915b926 in cmd_status builtin/commit.c:1547
    #7 0x5575090e1680 in run_builtin /home/anthony/src/c/git/git.c:466
    #8 0x5575090e1680 in handle_builtin /home/anthony/src/c/git/git.c:720
    #9 0x5575090e284a in run_argv /home/anthony/src/c/git/git.c:787
    #10 0x5575090e284a in cmd_main /home/anthony/src/c/git/git.c:920
    #11 0x5575090dbf82 in main /home/anthony/src/c/git/common-main.c:56
    #12 0x7f0a348230ab  (/lib64/libc.so.6+0x290ab)

Signed-off-by: Anthony Delannoy <anthony.2lannoy@gmail.com>
---
 preload-index.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/preload-index.c b/preload-index.c
index e5529a5863..a05f4d1390 100644
--- a/preload-index.c
+++ b/preload-index.c
@@ -148,6 +148,9 @@ void preload_index(struct index_state *index,
 		if (pthread_join(p->pthread, NULL))
 			die("unable to join threaded lstat");
 		t2_sum_lstat += p->t2_nr_lstat;
+
+		if (pathspec)
+			free(p->pathspec.items);
 	}
 	stop_progress(&pd.progress);
 
-- 
2.35.1

Re: [PATCH 1/1] pathspec: fix memleak

[Junio C Hamano]

Anthony Delannoy <anthony.2lannoy@gmail.com> writes:

> diff --git a/preload-index.c b/preload-index.c
> index e5529a5863..a05f4d1390 100644
> --- a/preload-index.c
> +++ b/preload-index.c
> @@ -148,6 +148,9 @@ void preload_index(struct index_state *index,
>  		if (pthread_join(p->pthread, NULL))
>  			die("unable to join threaded lstat");
>  		t2_sum_lstat += p->t2_nr_lstat;
> +
> +		if (pathspec)
> +			free(p->pathspec.items);
>  	}
>  	stop_progress(&pd.progress);

Given the way how copy_pathspec() makes a deep copy of a pathspec, I
suspect that this is still leaking all the resources held by the
array that is freed here.  Let's take a look:

        void copy_pathspec(struct pathspec *dst, const struct pathspec *src)
        {
                int i, j;

                *dst = *src;
                ALLOC_ARRAY(dst->items, dst->nr);
                COPY_ARRAY(dst->items, src->items, dst->nr);

Here, we copy the array of "struct pathspec_item".  But that is not
enough because ...

                for (i = 0; i < dst->nr; i++) {
                        struct pathspec_item *d = &dst->items[i];
                        struct pathspec_item *s = &src->items[i];

                        d->match = xstrdup(s->match);
                        d->original = xstrdup(s->original);

... each "struct pathspec_item" instance has pointer members like
these, and the copying of the array made these strings shared
between the src and dst arrays.  Here we make a copy of the string
owned by the element in the src array and give the copy to the
element in the dst array.

                        ALLOC_ARRAY(d->attr_match, d->attr_match_nr);
                        COPY_ARRAY(d->attr_match, s->attr_match, d->attr_match_nr);

Likewise for a separate array pointed by a member in "struct
pathspec_item" ...

                        for (j = 0; j < d->attr_match_nr; j++) {
                                const char *value = s->attr_match[j].value;
                                d->attr_match[j].value = xstrdup_or_null(value);

... which has a pointer member here ...

                        }

                        d->attr_check = attr_check_dup(s->attr_check);

... and here.  Both are deep-copied.

                }
        }

There is pathspec.c::clear_pathspec() API function, which looks as
if it was made for this exact use case.

I wonder if this is a good place to use it, perhaps like the
attached patch.

 preload-index.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git c/preload-index.c w/preload-index.c
index e5529a5863..100f7a374d 100644
--- c/preload-index.c
+++ w/preload-index.c
@@ -151,6 +151,12 @@ void preload_index(struct index_state *index,
 	}
 	stop_progress(&pd.progress);
 
+	if (pathspec) {
+		/* earlier we made deep copies for each thread to work with */
+		for (i = 0; i < threads; i++)
+			clear_pathspec(&data[i].pathspec);
+	}
+
 	trace_performance_leave("preload index");
 
 	trace2_data_intmax("index", NULL, "preload/sum_lstat", t2_sum_lstat);