After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 777932 - "From: " field in exported patch file is broken due to use-after-free
"From: " field in exported patch file is broken due to use-after-free
Status: RESOLVED FIXED
Product: libgit2-glib
Classification: Core
Component: General
3.22.x
Other Linux
: Normal normal
: ---
Assigned To: gitg-maint
gitg-maint
: 781263 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2017-01-30 11:39 UTC by Christian Stadelmann
Modified: 2019-02-22 03:51 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Backtraces from valgrind and gdb, including a full backtrace (t a a bt full) (26.75 KB, text/plain)
2017-01-30 11:39 UTC, Christian Stadelmann
  Details
Set correct native when setting email options author (1.15 KB, patch)
2017-05-06 10:52 UTC, Ernestas Kulik
committed Details | Review

Description Christian Stadelmann 2017-01-30 11:39:53 UTC
Created attachment 344528 [details]
Backtraces from valgrind and gdb, including a full backtrace (t a a bt full)

In patches I exported from gitg lately, the "From: " field is broken. See https://bug776413.bugzilla-attachments.gnome.org/attachment.cgi?id=344486 for an example.

Some examples:
> From:  <ð7šŸU>
> From: 0 <>
> From:  <ÐEšŸU>
> From:  <P/ÏíU>

I can reproduce this bug by following these steps:
1. open gitg on a repository (in my case gitg breaks on any repository)
2. select a commit (in my case gitg breaks on any commit)
3. right-click and click "Create patch"
4. select a filename to store the file at
5. confirm the dialog

So I ran $ valgrind --vgdb=full --vgdb-error=0 /usr/bin/gitg
and attached gdb to it and it reported a use-after-free at the exact moment when I save the patch file (step 5). It is attached, including a gdb backtrace.
Comment 1 Christian Stadelmann 2017-01-30 12:20:29 UTC
Sorry, I forgot to add the version numbers:

gitg-3.22.0-2.fc25.x86_64
libgit2-0.24.6-1.fc25.x86_64
libgit2-glib-0.24.4-2.fc25.x86_64
git-2.9.3-2.fc25.x86_64
Comment 2 Ernestas Kulik 2017-05-05 18:19:35 UTC
*** Bug 781263 has been marked as a duplicate of this bug. ***
Comment 3 Ernestas Kulik 2017-05-06 10:52:20 UTC
Created attachment 351255 [details] [review]
Set correct native when setting email options author

When setting the author for email options, the code makes a copy of the
signature parameter, but takes the native of the original object, which
can result in use-after-free when the original object is destroyed.
Comment 4 Ignacio Casal Quinteiro (nacho) 2017-05-06 18:04:01 UTC
Review of attachment 351255 [details] [review]:

good catch
Comment 5 Ernestas Kulik 2017-05-06 18:18:32 UTC
Attachment 351255 [details] pushed as 0e1e1bc - Set correct native when setting email options author