Commit 5cc3971a6a45e65edf3ac64e3c58c9d52fad57f1
2017-12-06T03:22:58
libFuzzer: Fix a git_packfile_stream leak This change ensures that the git_packfile_stream object in git_indexer_append() does not leak when the stream has errors. Found using libFuzzer.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
diff --git a/src/indexer.c b/src/indexer.c
index 15f6cc2..bd091d7 100644
--- a/src/indexer.c
+++ b/src/indexer.c
@@ -1118,6 +1118,9 @@ void git_indexer_free(git_indexer *idx)
if (idx == NULL)
return;
+ if (idx->have_stream)
+ git_packfile_stream_free(&idx->stream);
+
git_vector_free_deep(&idx->objects);
if (idx->pack->idx_cache) {
diff --git a/tests/pack/indexer.c b/tests/pack/indexer.c
index c73d397..a28ee3e 100644
--- a/tests/pack/indexer.c
+++ b/tests/pack/indexer.c
@@ -40,6 +40,17 @@ static const unsigned char thin_pack[] = {
};
static const unsigned int thin_pack_len = 78;
+/*
+ * Packfile that causes the packfile stream to open in a way in which it leaks
+ * the stream reader.
+ */
+static const unsigned char leaky_pack[] = {
+ 0x50, 0x41, 0x43, 0x4b, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x03,
+ 0xf4, 0xbd, 0x51, 0x51, 0x51, 0x51, 0x51, 0x72, 0x65, 0x41, 0x4b, 0x63,
+ 0x5f, 0x64, 0x65, 0x70, 0x74, 0x68, 0xbd, 0x41, 0x4b
+};
+static const unsigned int leaky_pack_len = 33;
+
static const unsigned char base_obj[] = { 07, 076 };
static const unsigned int base_obj_len = 2;
@@ -60,6 +71,22 @@ void test_pack_indexer__out_of_order(void)
git_indexer_free(idx);
}
+void test_pack_indexer__leaky(void)
+{
+ git_indexer *idx = 0;
+ git_transfer_progress stats = { 0 };
+
+ cl_git_pass(git_indexer_new(&idx, ".", 0, NULL, NULL, NULL));
+ cl_git_pass(git_indexer_append(
+ idx, leaky_pack, leaky_pack_len, &stats));
+ cl_git_fail(git_indexer_commit(idx, &stats));
+
+ cl_assert(giterr_last() != NULL);
+ cl_assert_equal_i(giterr_last()->klass, GITERR_INDEXER);
+
+ git_indexer_free(idx);
+}
+
void test_pack_indexer__fix_thin(void)
{
git_indexer *idx = NULL;