Skip to content

Check for strings before attempting to xfree them#991

Open
djberg96 wants to merge 1 commit intolibgit2:masterfrom
djberg96:fix_munmap_chunk_invalid_pointer
Open

Check for strings before attempting to xfree them#991
djberg96 wants to merge 1 commit intolibgit2:masterfrom
djberg96:fix_munmap_chunk_invalid_pointer

Conversation

@djberg96
Copy link

@djberg96 djberg96 commented Sep 8, 2025

The rugged_rb_ary_to_strarray function uses xmalloc to allocate memory for str_array->strings, but there are several cases where this memory might not be allocated:

If rb_array is NIL_P, the function returns early with strings = NULL. If there's an empty array, the count would be 0. However, in the cleanup sections, the code unconditionally calls xfree(custom_headers.strings) without checking if it's NULL. This can cause "munmap_chunk(): invalid pointer" errors.

Should fix #859

@djberg96
Copy link
Author

@carlosmn Look ok?

@djberg96
Copy link
Author

Anyone home?

@carlosmn
Copy link
Member

Are you sure calling xfree on NULL can cause an "invalid pointer" error? Doing nothing when passed NULL is the behaviour that any allocator should have, and indeed chasing down xfree in ruby through ruby_xfree to ruby_sized_xfree, we can see in https://github.com/ruby/ruby/blob/373eacb8416f8b20e89e2b52dc007c5958a79bdb/gc.c#L5442 that if does nothing if this is NULL.

Now, if we end up mixing up something like Qnil with NULL and then try to free that, that I can see causing trouble, but this would not fix that as this is doing the same check that xfree ends up doing, just a few calls higher in the stack.

@carlosmn
Copy link
Member

What I'm noticing now is that we are calling the wrong free function completely, and causing memory leaks. Rugged should always be using the ruby allocator but if we don't end up doing that, xfree is the wrong allocator to use.

On top of that, we should be using git_strarray_dispose in order to actually free the memory and not just he array containing them.

@djberg96
Copy link
Author

Indeed, my original PR was superficial. I'm working on updating it...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

segfault in check_connection

3 participants