@matheusbsbs / matheus-bagliano / commits / 5dbaec628d

sequencer: rework reflog message handling

It has been reported that "git rebase --rebase-merges" can create corrupted reflog entries like e9c962f2ea0 HEAD@{8}: <binary>�: Merged in <branch> (pull request #4441) This is due to a use-after-free bug that happens because reflog_message() uses a static `struct strbuf` and is not called to update the current reflog message stored in `ctx->reflog_message` when creating the merge. This means `ctx->reflog_message` points to a stale reflog message that has been freed by subsequent call to reflog_message() by a command such as `reset` that used the return value directly rather than storing the result in `ctx->reflog_message`. Fix this by creating the reflog message nearer to where the commit is created and storing it in a local variable which is passed as an additional parameter to run_git_commit() rather than storing the message in `struct replay_ctx`. This makes it harder to forget to call `reflog_message()` before creating a commit and using a variable with a narrower scope means that a stale value cannot carried across a from one iteration of the loop to the next which should prevent any similar use-after-free bugs in the future. A existing test is modified to demonstrate that merges are now created with the correct reflog message. Reported-by: Kristoffer Haugsbakk <code@khaugsbakk.name> Signed-off-by: Phillip Wood <phillip.wood@dunelm.org.uk> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Phillip Wood committed May 9, 2025 at 16:22 UTC 5dbaec628d6dfbdc4db9ac528d2b77cc4286d70a

2 files changed +34 -27

sequencer.c

+24 -26

@@ -224,11 +224,6 @@ struct replay_ctx {

224 * current chain.

225 */

226 struct strbuf current_fixups;

227 - /*

228 - * Stores the reflog message that will be used when creating a

229 - * commit. Points to a static buffer and should not be free()'d.

230 - */

231 - const char *reflog_message;

227 /*

228 * The number of completed fixup and squash commands in the

229 * current chain.

@@ -1133,10 +1128,10 @@ static int run_command_silent_on_success(struct child_process *cmd)

1128 * author metadata.

1129 */

1130 static int run_git_commit(const char *defmsg,

1131 + const char *reflog_action,

1132 struct replay_opts *opts,

1133 unsigned int flags)

1134 {

1139 - struct replay_ctx *ctx = opts->ctx;

1135 struct child_process cmd = CHILD_PROCESS_INIT;

1136

1137 if ((flags & CLEANUP_MSG) && (flags & VERBATIM_MSG))

@@ -1154,7 +1149,7 @@ static int run_git_commit(const char *defmsg,

1149 gpg_opt, gpg_opt);

1150 }

1151

1157 - strvec_pushf(&cmd.env, GIT_REFLOG_ACTION "=%s", ctx->reflog_message);

1152 + strvec_pushf(&cmd.env, GIT_REFLOG_ACTION "=%s", reflog_action);

1153

1154 if (opts->committer_date_is_author_date)

1155 strvec_pushf(&cmd.env, "GIT_COMMITTER_DATE=%s",

@@ -1538,10 +1533,10 @@ static int parse_head(struct repository *r, struct commit **head)

1533 */

1534 static int try_to_commit(struct repository *r,

1535 struct strbuf *msg, const char *author,

1536 + const char *reflog_action,

1537 struct replay_opts *opts, unsigned int flags,

1538 struct object_id *oid)

1539 {

1544 - struct replay_ctx *ctx = opts->ctx;

1540 struct object_id tree;

1541 struct commit *current_head = NULL;

1542 struct commit_list *parents = NULL;

@@ -1703,7 +1698,7 @@ static int try_to_commit(struct repository *r,

1698 goto out;

1699 }

1700

1706 - if (update_head_with_reflog(current_head, oid, ctx->reflog_message,

1701 + if (update_head_with_reflog(current_head, oid, reflog_action,

1702 msg, &err)) {

1703 res = error("%s", err.buf);

1704 goto out;

@@ -1734,6 +1729,7 @@ static int write_rebase_head(struct object_id *oid)

1729

1730 static int do_commit(struct repository *r,

1731 const char *msg_file, const char *author,

1732 + const char *reflog_action,

1733 struct replay_opts *opts, unsigned int flags,

1734 struct object_id *oid)

1735 {

@@ -1749,7 +1745,7 @@ static int do_commit(struct repository *r,

1745 msg_file);

1746

1747 res = try_to_commit(r, msg_file ? &sb : NULL,

1752 - author, opts, flags, &oid);

1748 + author, reflog_action, opts, flags, &oid);

1749 strbuf_release(&sb);

1750 if (!res) {

1751 refs_delete_ref(get_main_ref_store(r), "",

@@ -1765,7 +1761,7 @@ static int do_commit(struct repository *r,

1761 if (is_rebase_i(opts) && oid)

1762 if (write_rebase_head(oid))

1763 return -1;

1768 - return run_git_commit(msg_file, opts, flags);

1764 + return run_git_commit(msg_file, reflog_action, opts, flags);

1765 }

1766

1767 return res;

@@ -2278,13 +2274,19 @@ static int do_pick_commit(struct repository *r,

2274 const char *msg_file = should_edit(opts) ? NULL : git_path_merge_msg(r);

2275 struct object_id head;

2276 struct commit *base, *next, *parent;

2281 - const char *base_label, *next_label;

2277 + const char *base_label, *next_label, *reflog_action;

2278 char *author = NULL;

2279 struct commit_message msg = { NULL, NULL, NULL, NULL };

2280 int res, unborn = 0, reword = 0, allow, drop_commit;

2281 enum todo_command command = item->command;

2282 struct commit *commit = item->commit;

2283

2284 + if (is_rebase_i(opts))

2285 + reflog_action = reflog_message(

2286 + opts, command_to_string(item->command), NULL);

2287 + else

2288 + reflog_action = sequencer_reflog_action(opts);

2289 +

2290 if (opts->no_commit) {

2291 /*

2292 * We do not intend to commit immediately. We just want to

@@ -2536,14 +2538,15 @@ static int do_pick_commit(struct repository *r,

2538 } /* else allow == 0 and there's nothing special to do */

2539 if (!opts->no_commit && !drop_commit) {

2540 if (author || command == TODO_REVERT || (flags & AMEND_MSG))

2539 - res = do_commit(r, msg_file, author, opts, flags,

2541 + res = do_commit(r, msg_file, author, reflog_action,

2542 + opts, flags,

2543 commit? &commit->object.oid : NULL);

2544 else

2545 res = error(_("unable to parse commit author"));

2546 *check_todo = !!(flags & EDIT_MSG);

2547 if (!res && reword) {

2548 fast_forward_edit:

2546 - res = run_git_commit(NULL, opts, EDIT_MSG |

2549 + res = run_git_commit(NULL, reflog_action, opts, EDIT_MSG |

2550 VERIFY_MSG | AMEND_MSG |

2551 (flags & ALLOW_EMPTY));

2552 *check_todo = 1;

@@ -4092,6 +4095,7 @@ static int do_merge(struct repository *r,

4095 int merge_arg_len, oneline_offset, can_fast_forward, ret, k;

4096 static struct lock_file lock;

4097 const char *p;

4098 + const char *reflog_action = reflog_message(opts, "merge", NULL);

4099

4100 if (repo_hold_locked_index(r, &lock, LOCK_REPORT_ON_ERROR) < 0) {

4101 ret = -1;

@@ -4370,14 +4374,15 @@ static int do_merge(struct repository *r,

4374 * value (a negative one would indicate that the `merge`

4375 * command needs to be rescheduled).

4376 */

4373 - ret = !!run_git_commit(git_path_merge_msg(r), opts,

4374 - run_commit_flags);

4377 + ret = !!run_git_commit(git_path_merge_msg(r), reflog_action,

4378 + opts, run_commit_flags);

4379

4380 if (!ret && flags & TODO_EDIT_MERGE_MSG) {

4381 fast_forward_edit:

4382 *check_todo = 1;

4383 run_commit_flags |= AMEND_MSG | EDIT_MSG | VERIFY_MSG;

4380 - ret = !!run_git_commit(NULL, opts, run_commit_flags);

4384 + ret = !!run_git_commit(NULL, reflog_action, opts,

4385 + run_commit_flags);

4386 }

4387

4388

@@ -4892,13 +4897,9 @@ static int pick_one_commit(struct repository *r,

4897 struct replay_opts *opts,

4898 int *check_todo, int* reschedule)

4899 {

4895 - struct replay_ctx *ctx = opts->ctx;

4900 int res;

4901 struct todo_item *item = todo_list->items + todo_list->current;

4902 const char *arg = todo_item_get_arg(todo_list, item);

4899 - if (is_rebase_i(opts))

4900 - ctx->reflog_message = reflog_message(

4901 - opts, command_to_string(item->command), NULL);

4903

4904 res = do_pick_commit(r, item, opts, is_final_fixup(todo_list),

4905 check_todo);

@@ -4957,7 +4958,6 @@ static int pick_commits(struct repository *r,

4958 struct replay_ctx *ctx = opts->ctx;

4959 int res = 0, reschedule = 0;

4960

4960 - ctx->reflog_message = sequencer_reflog_action(opts);

4961 if (opts->allow_ff)

4962 assert(!(opts->signoff || opts->no_commit ||

4963 opts->record_origin || should_edit(opts) ||

@@ -5218,6 +5218,7 @@ static int commit_staged_changes(struct repository *r,

5218 unsigned int flags = ALLOW_EMPTY | EDIT_MSG;

5219 unsigned int final_fixup = 0, is_clean;

5220 struct strbuf rev = STRBUF_INIT;

5221 + const char *reflog_action = reflog_message(opts, "continue", NULL);

5222 int ret;

5223

5224 if (has_unstaged_changes(r, 1)) {

@@ -5380,7 +5381,7 @@ static int commit_staged_changes(struct repository *r,

5381 }

5382

5383 if (run_git_commit(final_fixup ? NULL : rebase_path_message(),

5383 - opts, flags)) {

5384 + reflog_action, opts, flags)) {

5385 ret = error(_("could not commit staged changes."));

5386 goto out;

5387 }

@@ -5412,7 +5413,6 @@ out:

5413

5414 int sequencer_continue(struct repository *r, struct replay_opts *opts)

5415 {

5415 - struct replay_ctx *ctx = opts->ctx;

5416 struct todo_list todo_list = TODO_LIST_INIT;

5417 int res;

5418

@@ -5433,7 +5433,6 @@ int sequencer_continue(struct repository *r, struct replay_opts *opts)

5433 unlink(rebase_path_dropped());

5434 }

5435

5436 - ctx->reflog_message = reflog_message(opts, "continue", NULL);

5436 if (commit_staged_changes(r, opts, &todo_list)) {

5437 res = -1;

5438 goto release_todo_list;

@@ -5485,7 +5484,6 @@ static int single_pick(struct repository *r,

5484 TODO_PICK : TODO_REVERT;

5485 item.commit = cmit;

5486

5488 - opts->ctx->reflog_message = sequencer_reflog_action(opts);

5487 return do_pick_commit(r, &item, opts, 0, &check_todo);

5488 }

5489

t/t3430-rebase-merges.sh

+10 -1

@@ -86,7 +86,7 @@ test_expect_success 'create completely different structure' '

86 test_config sequence.editor \""$PWD"/replace-editor.sh\" &&

87 test_tick &&

88 git rebase -i -r A main &&

89 - test_cmp_graph <<-\EOF

89 + test_cmp_graph <<-\EOF &&

90 * Merge the topic branch '\''onebranch'\''

91 |\

92 | * D

@@ -99,6 +99,15 @@ test_expect_success 'create completely different structure' '

99 |/

100 * A

101 EOF

102 +

103 + head="$(git show-ref --verify -s --abbrev HEAD)" &&

104 + cat >expect <<-EOF &&

105 + $head HEAD@{0}: rebase (finish): returning to refs/heads/main

106 + $head HEAD@{1}: rebase (merge): Merge the topic branch ${SQ}onebranch${SQ}

107 + EOF

108 +

109 + git reflog -n2 HEAD >actual &&

110 + test_cmp expect actual

111 '

112

113 test_expect_success 'generate correct todo list' '