Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Fix invalid memory references #3814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 14, 2016
Merged

Conversation

pks-t
Copy link
Member

@pks-t pks-t commented Jun 7, 2016

Two small fixes for invalid memory references. As always, some details are included in the commit messages.

I've pushed a fix similar to the smart-transports commit once before, but back then the fix wasn't as obvious and as I wasn't able to recap my own thought process when you asked about the non-obvious fix I simply dropped the commit. But I hope the issue should be clear now.

pks-t added 2 commits June 7, 2016 09:14
When we receive a packet of exactly four bytes encoding its
length as those four bytes it can be treated as an empty line.
While it is not really specified how those empty lines should be
treated, we currently ignore them and do not return an error when
trying to parse it but simply advance the data pointer.

Callers invoking `git_pkt_parse_line` are currently not prepared
to handle this case as they do not explicitly check this case.
While they could always reset the passed out-pointer to `NULL`
before calling `git_pkt_parse_line` and determine if the pointer
has been set afterwards, it makes more sense to update
`git_pkt_parse_line` to set the out-pointer to `NULL` itself when
it encounters such an empty packet. Like this it is guaranteed
that there will be no invalid memory references to free'd
pointers.

As such, the issue has been fixed such that `git_pkt_parse_line`
always sets the packet out pointer to `NULL` when an empty packet
has been received and callers check for this condition, skipping
such packets.
When removing an entry from the index by its position, we first
retrieve the position from the index's entries and then try to
remove the retrieved value from the index map with
`DELETE_IN_MAP`. When `index_remove_entry` returns `NULL` we try
to feed it into the `DELETE_IN_MAP` macro, which will
unconditionally call `idxentry_hash` and then happily dereference
the `NULL` entry pointer.

Fix the issue by not passing a `NULL` entry into `DELETE_IN_MAP`.
@ethomson
Copy link
Member

This looks good to me. In reference to one of your comments:

While they could always reset the passed out-pointer to NULL
before calling git_pkt_parse_line and determine if the pointer
has been set afterwards, it makes more sense to update
git_pkt_parse_line to set the out-pointer to NULL itself when
it encounters such an empty packet.

Indeed this is the expectation - although this is not codified in a document, the expectation is that functions that take out-params should always set those, even in error cases. 👍

@ethomson ethomson merged commit 65e4ab7 into libgit2:master Jun 14, 2016
@pks-t pks-t deleted the pks/invalid-memrefs branch June 21, 2016 05:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants