laumann/ani - Change PYNIQ644Z3Y3ADNE642GCJUJLUQRYZKHZ7ERKVDVLRTBPZPHQWMQC

change: fix potential heap use-after-free

The change being presented is sort of special in that we need all its hunks plus contents. But it was placed in the changestore along with all the other changes, and that storage might get realloc()'ed because new changes need to be loaded. This would render any pointers into the contents of the changestore invalid, which will happen for the hunks being inspected.

A better overhaul is probably needed (something sans-io like), but for now we move the first change, the change that the user wants to get printed, out of the changestore and manage it separately. It is the only change where we need to look at its hunks. '

Created by laumann on July 17, 2024

PYNIQ644Z3Y3ADNE642GCJUJLUQRYZKHZ7ERKVDVLRTBPZPHQWMQC

Dependencies

In discussions

#16 make check2: AddressSanitizer: heap-use-after-free on address 0x618000000140

Change contents

Replacement in change.c at line 522 [6.1047]

B:BD[5.2010] → [4.598:673]

	struct changestore *changes, struct atom *change, u8 *contents,
	usize *n

[5.2010]

[5.2091]

	struct changestore *changes, struct atom *change, u8 *contents, usize *n

Replacement in change.c at line 572 [6.1047]
∅:D[7.608] → [5.3360:3381]
B:BD[5.3360] → [5.3360:3381]
B:BD[5.3381] → [4.825:856]
∅:D[4.856] → [5.3417:3425]
B:BD[5.3417] → [5.3417:3425]
```
					buf = xrealloc(
						buf, sz + sizeof(u8) * z
					);
```
[7.608]
[7.609]
```
					buf = xrealloc(buf, sz + sizeof(u8) * z);
```

Replacement in change.c at line 689 [6.1047]

B:BD[8.609] → [4.1043:1103]

∅:D[4.1103] → [8.674:687]

B:BD[8.674] → [8.674:687]

	struct changestore *changes, struct atom *a, u8 *contents,
	int verbose

[8.609]

[8.687]

	struct changestore *changes, struct atom *a, u8 *contents, int verbose

Replacement in change.c at line 756 [6.1047]
B:BD[9.2775] → [9.2775:2800]
B:BD[9.2800] → [4.1215:1273]
∅:D[4.1273] → [9.2864:2866]
B:BD[9.2864] → [9.2864:2866]
```
read_filemetadata_noenc(
	struct filemetadata *m, u8 *contents, usize contents_len
)
```
[9.2775]
[9.2866]
```
read_filemetadata_noenc(struct filemetadata *m, u8 *contents, usize contents_len)
```

Replacement in change.c at line 769 [6.1047]

B:BD[3.8] → [3.8:73]

print_raw_change(struct changestore *changes, struct change *ch)

[3.8]

[3.73]

print_raw_change(struct change *ch)

Replacement in change.c at line 1108 [6.1047]

B:BD[10.776] → [10.776:832]

 * load a change by the given hash into the changestore

[10.776]

[10.832]

 * Load a change by the given hash into the changestore.
 *
 * This function may realloc the underlying memory, so callers must
 * ensure they are not holding any references to any changes.

Insertion in change.c at line 1141 [6.1047]

[10.1324]

[4.1542]

changefree(struct change *c)
{
	hashedfree(&c->hashed);
	if (c->contents)
		free(c->contents);
}
void

Deletion in change.c at line 1161 [6.1047]
∅:D[4.1624] → [10.1575:1594]
B:BD[10.1575] → [10.1575:1594]
```
	struct change *c;
```

Replacement in change.c at line 1164 [6.1047]

B:BD[10.1661] → [10.1661:1757]

		c = &s->entries[i].change;
		hashedfree(&c->hashed);
		if (c->contents)
			free(c->contents);

[10.1661]

[10.1757]

		changefree(&s->entries[i].change);

Replacement in change.c at line 1211 [6.1047]
B:BD[5.8253] → [5.8253:8278]
B:BD[5.8278] → [4.1639:1649]
∅:D[4.1649] → [5.8292:8293]
∅:D[9.3556] → [5.8292:8293]
B:BD[5.8292] → [5.8292:8293]
B:BD[5.8293] → [11.513:560]
∅:D[11.560] → [5.8329:8360]
∅:D[10.2474] → [5.8329:8360]
B:BD[5.8329] → [5.8329:8360]
```
	struct changeentry *ch;
	usize x;
	changestoreinit(&changestore, 4, repo->path);
	ch = &changestore.entries[0];
```
[5.8253]
[5.8360]
```
	struct change c = { 0 };
	struct hash h = { 0 };
```

Replacement in change.c at line 1214 [6.1047]

B:BD[5.8361] → [2.15099:15160]

	err = loadchange(&ch->change, &ch->hash, repo->path, hash);

[5.8361]

[5.8428]

	err = loadchange(&c, &h, repo->path, hash);

Deletion in change.c at line 1217 [6.1047]
B:BD[2.15179] → [2.15179:15180]
∅:D[2.15180] → [12.0:26]
B:BD[5.8452] → [12.0:26]
```
	changestore.len = x = 1;
```
Replacement in change.c at line 1218 [6.1047]
B:BD[5.8483] → [5.8483:8516]
```
	changestore.entries[0].num = 1;
```
[5.8483]
[5.9129]
```
	changestoreinit(&changestore, 4, repo->path);
```
Replacement in change.c at line 1221 [6.1047]
B:BD[3.814] → [3.814:861]
```
		print_raw_change(&changestore, &ch->change);
```
[3.814]
[3.861]
```
		print_raw_change(&c);
```

Replacement in change.c at line 1223 [6.1047]

B:BD[3.867] → [3.867:957]

		print_change(
			&changestore, &ch->change.hashed, ch->change.contents,
			verbose
		);

[3.867]

[5.9226]

		print_change(&changestore, &c.hashed, c.contents, verbose);

Insertion in change.c at line 1227 [6.1047]
[5.9270]
[6.2983]
```
	changefree(&c);
```

change: fix potential heap use-after-free

Dependencies

In discussions

Change contents

Replacement in change.c at line 522 [6.1047]

Replacement in change.c at line 572 [6.1047]

Replacement in change.c at line 689 [6.1047]

Replacement in change.c at line 756 [6.1047]

Replacement in change.c at line 769 [6.1047]

Replacement in change.c at line 1108 [6.1047]

Insertion in change.c at line 1141 [6.1047]

Deletion in change.c at line 1161 [6.1047]

Replacement in change.c at line 1164 [6.1047]

Replacement in change.c at line 1211 [6.1047]

Replacement in change.c at line 1214 [6.1047]

Deletion in change.c at line 1217 [6.1047]

Replacement in change.c at line 1218 [6.1047]

Replacement in change.c at line 1221 [6.1047]

Replacement in change.c at line 1223 [6.1047]

Insertion in change.c at line 1227 [6.1047]