git-commit-vandalism/builtin
Ævar Arnfjörð Bjarmason 9903623761 receive-pack: fix use-after-free bug
The resolve_ref_unsafe() function can, and sometimes will in the case
of this codepath, return the char * passed to it to the caller. In
this case we construct a strbuf, free it, and then continue using the
dst_name after that free().

The code being fixed dates back to da3efdb17b ("receive-pack: detect
aliased updates which can occur with symrefs", 2010-04-19). When it
was originally added it didn't have this bug, it was introduced when
it was subsequently modified to use strbuf in 6b01ecfe22 ("ref
namespaces: Support remote repositories via upload-pack and
receive-pack", 2011-07-08).

This is theoretically a security issue, the C standard makes no
guarantees that a value you use after free() hasn't been poked at or
changed by something else on the system, but in practice modern OSs
will have mapped the relevant page to this process, so nothing else
would have used it. We do no further allocations between the free()
and use-after-free, so we ourselves didn't corrupt or change the
value.

Jeff investigated that and found: "It probably would be an issue if
the allocation were larger. glibc at least will use mmap()/munmap()
after some cutoff[1], in which case we'd get a segfault from hitting
the unmapped page. But for small allocations, it just bumps brk() and
the memory is still available for further allocations after
free(). [...] If you had a sufficiently large refname you might be
able to trigger the bug [...]. I tried to push such a ref. I had to
manually make a packed-refs file with the long name to avoid
filesystem limits (though probably you could have a long a/b/c/ name
on ext4).  But the result can't actually be pushed, because it all has
to fit into a 64k pkt-line as part of the push protocol.".

An a alternative and more succinct way of implementing this would have
been to do the strbuf_release() at the end of check_aliased_update()
and use "goto out" instead of the early "return" statements. Hopefully
this approach of using a helper instead makes it easier to follow.

1. Jeff: "Weirdly, the mmap() cutoff on my glibc system is 135168
   bytes. Which is...2^17 + 2^12? 33 pages? I'm sure there's a good
   reason for that, but I didn't dig into it."

Reported-by: 王健强 <jianqiang.wang@securitygossip.com>
Helped-by: Jeff King <peff@peff.net>
Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2019-02-20 15:02:12 -08:00
..
add.c Merge branch 'ma/lockfile-cleanup' 2018-05-30 14:04:05 +09:00
am.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
annotate.c
apply.c
archive.c correct error messages for NULL packet_read_line() 2018-02-08 12:37:30 -08:00
bisect--helper.c bisect: mention "view" as an alternative to "visualize" 2017-11-13 10:51:14 +09:00
blame.c Merge branch 'sb/blame-color' 2018-06-18 10:18:45 -07:00
branch.c Merge branch 'rd/doc-remote-tracking-with-hyphen' 2018-06-18 10:18:43 -07:00
bundle.c
cat-file.c Merge branch 'js/use-bug-macro' 2018-05-30 14:04:07 +09:00
check-attr.c
check-ignore.c check-ignore: fix mix of directories and other file types 2018-02-12 13:09:35 -08:00
check-mailmap.c
check-ref-format.c Merge branch 'jc/check-ref-format-oor' into maint 2017-11-15 12:04:57 +09:00
checkout-index.c parse-options: let OPT__FORCE take optional flags argument 2018-02-09 10:24:50 -08:00
checkout.c Merge branch 'ma/unpack-trees-free-msgs' 2018-05-30 21:51:29 +09:00
clean.c completion: use __gitcomp_builtin in _git_clean 2018-02-09 10:24:50 -08:00
clone.c Merge branch 'bw/ref-prefix-for-configured-refspec' 2018-05-30 21:51:26 +09:00
column.c column: fix off-by-one default width 2018-05-13 10:45:05 +09:00
commit-graph.c commit-graph: implement "--append" option 2018-04-11 10:43:02 +09:00
commit-tree.c sha1_file: convert assert_sha1_type to object_id 2018-03-14 09:23:49 -07:00
commit.c Merge branch 'bp/status-rename-config' 2018-05-30 14:04:07 +09:00
config.c Merge branch 'jk/config-blob-sans-repo' 2018-05-30 21:51:27 +09:00
count-objects.c packfile: convert has_sha1_pack to object_id 2018-05-02 13:59:49 +09:00
credential.c
describe.c Merge branch 'ma/lockfile-cleanup' 2018-05-30 14:04:05 +09:00
diff-files.c
diff-index.c
diff-tree.c object: rename function 'typename' to 'type_name' 2018-02-14 13:10:05 -08:00
diff.c treewide: replace maybe_tree with accessor methods 2018-04-11 10:47:16 +09:00
difftool.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
fast-export.c Merge branch 'bw/ref-prefix-for-configured-refspec' 2018-05-30 21:51:26 +09:00
fetch-pack.c Merge branch 'bw/protocol-v2' 2018-05-08 15:59:16 +09:00
fetch.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
fmt-merge-msg.c sha1_file: convert read_sha1_file to struct object_id 2018-03-14 09:23:50 -07:00
for-each-ref.c
fsck.c Merge branch 'bc/object-id' 2018-05-30 14:04:10 +09:00
gc.c Merge branch 'ma/lockfile-cleanup' 2018-05-30 14:04:05 +09:00
get-tar-commit-id.c
grep.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
hash-object.c exec_cmd: rename to use dash in file name 2018-04-11 18:11:00 +09:00
help.c Merge branch 'nd/command-list' 2018-06-01 15:06:37 +09:00
index-pack.c Merge branch 'jk/index-pack-maint' 2018-06-13 12:50:46 -07:00
init-db.c Merge branch 'rd/init-typo' 2018-06-01 15:06:40 +09:00
interpret-trailers.c Merge branch 'jk/trailers-parse' 2017-08-26 22:55:04 -07:00
log.c Use OPT_SET_INT_F() for cmdline option specification 2018-05-24 16:12:29 +09:00
ls-files.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
ls-remote.c Merge branch 'bw/server-options' 2018-05-23 14:38:15 +09:00
ls-tree.c cache.h: add repository argument to oid_object_info 2018-04-26 10:54:27 +09:00
mailinfo.c
mailsplit.c
merge-base.c Merge branch 'ma/reduce-heads-leakfix' 2017-11-15 12:14:32 +09:00
merge-file.c
merge-index.c
merge-ours.c Merge branch 'bw/diff-opt-impl-to-bitfields' 2017-11-09 14:31:27 +09:00
merge-recursive.c
merge-tree.c exec_cmd: rename to use dash in file name 2018-04-11 18:11:00 +09:00
merge.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
mktag.c replace-object: add repository argument to lookup_replace_object 2018-04-12 11:38:56 +09:00
mktree.c cache.h: add repository argument to oid_object_info 2018-04-26 10:54:27 +09:00
mv.c Merge branch 'ma/lockfile-cleanup' 2018-05-30 14:04:05 +09:00
name-rev.c Convert find_unique_abbrev* to struct object_id 2018-03-14 09:23:48 -07:00
notes.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
pack-objects.c Merge branch 'nd/use-opt-int-set-f' 2018-06-01 15:06:38 +09:00
pack-redundant.c pack-redundant: convert linked lists to use struct object_id 2018-05-02 13:59:50 +09:00
pack-refs.c refs: add repository argument to get_main_ref_store 2018-04-12 11:38:56 +09:00
patch-id.c
prune-packed.c packfile: convert has_sha1_pack to object_id 2018-05-02 13:59:49 +09:00
prune.c cache.h: add repository argument to oid_object_info 2018-04-26 10:54:27 +09:00
pull.c Merge branch 'rd/doc-remote-tracking-with-hyphen' 2018-06-18 10:18:43 -07:00
push.c transport: convert transport_push to take a struct refspec 2018-05-18 06:19:44 +09:00
read-tree.c lock_file: move static locks into functions 2018-05-10 14:55:40 +09:00
rebase--helper.c rebase -i: introduce --rebase-merges=[no-]rebase-cousins 2018-04-26 12:28:43 +09:00
receive-pack.c receive-pack: fix use-after-free bug 2019-02-20 15:02:12 -08:00
reflog.c Merge branch 'ds/lazy-load-trees' 2018-05-23 14:38:13 +09:00
remote-ext.c
remote-fd.c
remote.c Merge branch 'bw/ref-prefix-for-configured-refspec' 2018-05-30 21:51:26 +09:00
repack.c repack: add --keep-pack option 2018-04-16 13:52:29 +09:00
replace.c Merge branch 'js/deprecate-grafts' 2018-05-23 14:38:17 +09:00
rerere.c
reset.c builtin/reset: convert use of EMPTY_TREE_SHA1_BIN 2018-05-02 13:59:52 +09:00
rev-list.c Merge branch 'bc/object-id' 2018-04-10 08:25:45 +09:00
rev-parse.c Merge branch 'en/rev-parse-invalid-range' 2018-06-01 15:06:39 +09:00
revert.c sequencer: improve config handling 2017-12-13 11:15:14 -08:00
rm.c Merge branch 'ma/lockfile-cleanup' 2018-05-30 14:04:05 +09:00
send-pack.c remote: convert match_push_refs to take a struct refspec 2018-05-18 06:19:44 +09:00
serve.c serve: introduce git-serve 2018-03-15 12:01:08 -07:00
shortlog.c Merge branch 'ps/contains-id-error-message' 2018-04-10 16:28:20 +09:00
show-branch.c Convert find_unique_abbrev* to struct object_id 2018-03-14 09:23:48 -07:00
show-ref.c Convert find_unique_abbrev* to struct object_id 2018-03-14 09:23:48 -07:00
stripspace.c
submodule--helper.c Sync with 2.17.2 2018-09-27 11:45:01 -07:00
symbolic-ref.c refs: rename constant REF_NODEREF to REF_NO_DEREF 2017-11-06 10:31:08 +09:00
tag.c Merge branch 'sb/oid-object-info' 2018-05-23 14:38:16 +09:00
unpack-file.c sha1_file: convert read_sha1_file to struct object_id 2018-03-14 09:23:50 -07:00
unpack-objects.c Sync with Git 2.17.1 2018-05-29 17:10:05 +09:00
update-index.c Merge branch 'js/use-bug-macro' 2018-05-30 14:04:07 +09:00
update-ref.c refs: rename constant REF_NODEREF to REF_NO_DEREF 2017-11-06 10:31:08 +09:00
update-server-info.c parse-options: let OPT__FORCE take optional flags argument 2018-02-09 10:24:50 -08:00
upload-archive.c
upload-pack.c Merge branch 'bw/protocol-v2' 2018-05-08 15:59:16 +09:00
var.c
verify-commit.c sha1_file: convert read_sha1_file to struct object_id 2018-03-14 09:23:50 -07:00
verify-pack.c
verify-tag.c ref-filter: use "struct object_id" consistently 2018-04-09 06:14:45 +09:00
worktree.c Merge branch 'tg/worktree-add-existing-branch' 2018-05-23 14:38:18 +09:00
write-tree.c cache-tree: convert write_*_as_tree to object_id 2018-03-14 09:23:47 -07:00