git-http-fetch Segmentation fault
Hi,
A friend of mine reported an easy to reproduce segmentation fault
when cloning through http from his repository:
"""
~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
got 299cdadd846913a052df361e973a947622f23198
walk 299cdadd846913a052df361e973a947622f23198
...
got 0ecd10d9d6ab020c2469a961777854afda705776/home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
"""
Sometimes it shows up as a corrupted double-linked list, detected by
glibc:
"""
*** glibc detected *** git-http-fetch: corrupted double-linked list: 0x080a5680 *** """
It's reproducible with Junio's master and maint branches (3082ac and
53a582 respectivelly).
BTW, At line 406 (the trap command), git-clone script removes the
directory it was fetching. This removes the core dump file too. We should not remove the directory if there's a core dump in there.
Signature · 1 line
Luiz Fernando N. Capitulino
"Luiz Fernando N. Capitulino" <[email protected]> escreveu:
Quoted 12 lines
A friend of mine reported an easy to reproduce segmentation fault
when cloning through http from his repository:"""
~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git
got299cdadd846913a052df361e973a947622f23198
walk299cdadd846913a052df361e973a947622f23198
...
got0ecd10d9d6ab020c2469a961777854afda705776/home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1"
"""
Quoted 2 lines
Sometimes it shows up as a corrupted double-linked list, detected by
glibc:
Does not seem to reproduce for me on my x86_64 box nor an i386 box I happened to have access to. Both run Debian etch.
Here is an excerpt from a valgrind run on the x86_64 box. It does seem to find a handful "problematic" accesses, but all seem to be in the system libraries. I did not get any errors on the i386 box.
: gitster v/master; valgrind git-http-fetch -v -a -w remotes/origin/master 299cdadd846913a052df361e973a947622f23198 http://people.mandriva.com/~boiko/mandrivamenu.git/
==2120== Conditional jump or move depends on uninitialised value(s)
==2120== at 0x4010AEE: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010AF9: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010B04: (within /lib/ld-2.3.6.so) ==2120== by 0x4006CB6: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Conditional jump or move depends on uninitialised value(s) ==2120== at 0x4010C61: (within /lib/ld-2.3.6.so) ==2120== by 0x4006E47: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0) ==2120== ==2120== Invalid read of size 8 ==2120== at 0x4010C54: (within /lib/ld-2.3.6.so) ==2120== by 0x4008D38: (within /lib/ld-2.3.6.so) ==2120== by 0x4004CF2: (within /lib/ld-2.3.6.so) ==2120== by 0x4006D6C: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== Address 0x5F096F0 is 16 bytes inside a block of size 23 alloc'd ==2120== at 0x4A1B858: malloc (vg_replace_malloc.c:149) ==2120== by 0x4007113: (within /lib/ld-2.3.6.so) ==2120== by 0x51FF260: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x51FECF7: _dl_open (in /lib/libc-2.3.6.so) ==2120== by 0x5201497: (within /lib/libc-2.3.6.so) ==2120== by 0x400B7D0: (within /lib/ld-2.3.6.so) ==2120== by 0x52014E1: __libc_dlopen_mode (in /lib/libc-2.3.6.so) ==2120== by 0x51DC456: __nss_lookup_function (in /lib/libc-2.3.6.so) ==2120== by 0x51B6FCE: (within /lib/libc-2.3.6.so) ==2120== by 0x51B7C06: getaddrinfo (in /lib/libc-2.3.6.so) ==2120== by 0x4ED31E2: (within /usr/lib/libcurl.so.3.0.0)
...
==2120==
==2120== IN SUMMARY: 6 errors from 5 contexts (suppressed: 9 from 1) ==2120==
Em Tue, 08 May 2007 13:04:47 -0700
Junio C Hamano <[email protected]> escreveu:
| "Luiz Fernando N. Capitulino" <[email protected]> escreveu: | | > A friend of mine reported an easy to reproduce segmentation fault | > when cloning through http from his repository: | > | > """ | > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git | > got 299cdadd846913a052df361e973a947622f23198 | > walk 299cdadd846913a052df361e973a947622f23198 | > ... | > got 0ecd10d9d6ab020c2469a961777854afda705776 | > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1" | > """ | > | > Sometimes it shows up as a corrupted double-linked list, detected by | > glibc: | | Does not seem to reproduce for me on my x86_64 box nor an i386 | box I happened to have access to. Both run Debian etch.
Forgot to say that you have to try a few times to reproduce.
Boiko, can you try it on another distro? NSL maybe? I only run
Mandriva on my machines.
Signature · 1 line
Luiz Fernando N. Capitulino
Em Tue, 8 May 2007 17:13:10 -0300
"Luiz Fernando N. Capitulino" <[email protected]> escreveu:
| Em Tue, 08 May 2007 13:04:47 -0700 | Junio C Hamano <[email protected]> escreveu: | | | "Luiz Fernando N. Capitulino" <[email protected]> escreveu: | | | | > A friend of mine reported an easy to reproduce segmentation fault | | > when cloning through http from his repository: | | > | | > """ | | > ~/ git clone http://people.mandriva.com/~boiko/mandrivamenu.git | | > got 299cdadd846913a052df361e973a947622f23198 | | > walk 299cdadd846913a052df361e973a947622f23198 | | > ... | | > got 0ecd10d9d6ab020c2469a961777854afda705776 | | > /home/lcapitulino/git//bin/git-clone: line 33: 22353 Segmentation fault (core dumped) git-http-fetch $v -a -w "$tname" "$sha1" "$1" | | > """ | | > | | > Sometimes it shows up as a corrupted double-linked list, detected by | | > glibc: | | | | Does not seem to reproduce for me on my x86_64 box nor an i386 | | box I happened to have access to. Both run Debian etch. | | Forgot to say that you have to try a few times to reproduce.
And, looks like you need http_proxy set too.
Sorry for the bad report. :-|
Signature · 1 line
Luiz Fernando N. Capitulino