Skip to content

Conversation

QiuYitai
Copy link

Hello,
Our team has recently been conducting research on a null-pointer-dereference (NPD) vulnerability detection tool and used it to scan libgit2 (the version on the master branch). After a manual review, we have identified some potentially vulnerable code snippets that may lead to null-pointer-dereference bugs.
The NULL Dereference vulnerability happens in int checkout_count_callback(), tests/libgit2/checkout/checkout_helpers.c
How the NULL Pointer Dereference happens:

  1. When workdir, baseline and target are null.
  2. Dereference of NULL variable baseline in baseline->path
int checkout_count_callback(
    git_checkout_notify_t why,
    const char *path,
    const git_diff_file *baseline,
    const git_diff_file *target,
    const git_diff_file *workdir,
    void *payload)
{
    checkout_counts *ct = payload;

    GIT_UNUSED(baseline); GIT_UNUSED(target); GIT_UNUSED(workdir);

    if (why & GIT_CHECKOUT_NOTIFY_CONFLICT) {
        ct->n_conflicts++;

=>      if (ct->debug) {
=>          if (workdir) { //false
               ......
            } else {
=>              if (baseline) {//false
                    ......
                } else {
=>                  if (target)//false
                        ......
                    else
                        fprintf(stderr, "How can a nonexistent file be a conflict (%s)\n", path);
                }
            }
        }
    }

    if (why & GIT_CHECKOUT_NOTIFY_DIRTY) {
        ct->n_dirty++;

        if (ct->debug) {
            if (workdir)
                fprintf(stderr, "M %s\n", workdir->path);
=>          else 
=>              fprintf(stderr, "D %s\n", baseline->path);
        }
    }

    .......
}

@ethomson
Copy link
Member

ethomson commented Jun 5, 2025

I'm pleased that your tool was only able to find a potential null reference vulnerability in some test code. 😁

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants