Use-after-free (?) in overwriteIndexFromFile
- Dominant language
- JavaScript
- Stars
- 233
- Forks
- 54
- PR merge metrics
- No merged PRs in 30d
Description
This is documented in more detail internally at http://jira/SDLC-37809, and I'll try to extract a public test case, but after switching to Node 18, we're seeing what appears to be memory corruption in libgit2, which as best as I can tell is because [overwriteIndexFromFile in node/lib/util/git_util.js](https://github.com/twosigma/git-meta/blob/b1e1908eed351a092972a9f314cb094cb03ae849/node/lib/util/git_util.js#L1041-L1059) opens up a NodeGit `Index` object (`newIndex`), stores the pointers to the `IndexEntry` objects it contains, and then allows the `Index` object to be freed. This mostly manifests as libgit2 complaining the file mode is zero, sometimes as libgit2 complaining a path is invalid, and at least once as a segfault in strcmp.
I suspect this isn't happening in the public repo's CI because we're not triggering the same memory-allocation patterns - the internal repo has about 15K submodules and is also using a pre-commit hook, both of which appear to be necessary.
Modifying the code to intentionally leak `newIndex` seems to avoid the memory corruption. I'm not actually sure how to properly do this with the exposed nodegit API, since there doesn't appear to be a deep-copy function on `IndexEntry`.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.