twosigma / twosigma/git-meta

Use-after-free (?) in overwriteIndexFromFile

Open
#882 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
233
Forks
54
PR merge metrics
No merged PRs in 30d

Description

This is documented in more detail internally at http://jira/SDLC-37809, and I'll try to extract a public test case, but after switching to Node 18, we're seeing what appears to be memory corruption in libgit2, which as best as I can tell is because [overwriteIndexFromFile in node/lib/util/git_util.js](https://github.com/twosigma/git-meta/blob/b1e1908eed351a092972a9f314cb094cb03ae849/node/lib/util/git_util.js#L1041-L1059) opens up a NodeGit `Index` object (`newIndex`), stores the pointers to the `IndexEntry` objects it contains, and then allows the `Index` object to be freed. This mostly manifests as libgit2 complaining the file mode is zero, sometimes as libgit2 complaining a path is invalid, and at least once as a segfault in strcmp.

I suspect this isn't happening in the public repo's CI because we're not triggering the same memory-allocation patterns - the internal repo has about 15K submodules and is also using a pre-commit hook, both of which appear to be necessary.

Modifying the code to intentionally leak `newIndex` seems to avoid the memory corruption. I'm not actually sure how to properly do this with the exposed nodegit API, since there doesn't appear to be a deep-copy function on `IndexEntry`.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.