Skip to content

Fix the null reference vulnerability. #7052

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Conversation

QiuYitai
Copy link

Hello,
Our team has recently been conducting research on a null-pointer-dereference (NPD) vulnerability detection tool and used it to scan libgit2 (the version on the master branch). After a manual review, we have identified some potentially vulnerable code snippets that may lead to null-pointer-dereference bugs.
The NULL Dereference vulnerability happens in int checkout_count_callback(), tests/libgit2/checkout/checkout_helpers.c
How the NULL Pointer Dereference happens:

  1. When workdir, baseline and target are null.
  2. Dereference of NULL variable baseline in baseline->path
int checkout_count_callback(
    git_checkout_notify_t why,
    const char *path,
    const git_diff_file *baseline,
    const git_diff_file *target,
    const git_diff_file *workdir,
    void *payload)
{
    checkout_counts *ct = payload;

    GIT_UNUSED(baseline); GIT_UNUSED(target); GIT_UNUSED(workdir);

    if (why & GIT_CHECKOUT_NOTIFY_CONFLICT) {
        ct->n_conflicts++;

=>      if (ct->debug) {
=>          if (workdir) { //false
               ......
            } else {
=>              if (baseline) {//false
                    ......
                } else {
=>                  if (target)//false
                        ......
                    else
                        fprintf(stderr, "How can a nonexistent file be a conflict (%s)\n", path);
                }
            }
        }
    }

    if (why & GIT_CHECKOUT_NOTIFY_DIRTY) {
        ct->n_dirty++;

        if (ct->debug) {
            if (workdir)
                fprintf(stderr, "M %s\n", workdir->path);
=>          else 
=>              fprintf(stderr, "D %s\n", baseline->path);
        }
    }

    .......
}

@ethomson
Copy link
Member

ethomson commented Jun 5, 2025

I'm pleased that your tool was only able to find a potential null reference vulnerability in some test code. 😁

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants