Re: A possible divide by zero problem in read-cache.c

[Matheus Tavares <matheus.bernardino@xxxxxx>]

On Thu, Apr 29, 2021 at 11:33 AM Yiyuan guo <yguoaz@xxxxxxxxx> wrote:
>
> Hello, git developers.
> I have found a possible divide by zero problem in read-cache.c. Here
> is the trace (with links to code location) for triggering the bug:
>
> Step 0: (In function do_read_index) [ link:
> https://github.com/git/git/blob/311531c9de557d25ac087c1637818bd2aad6eb3a/read-cache.c#L2216
> ]
>       nr_threads = istate->cache_nr / THREAD_COST;
> If istate->cache_nr == 0, nr_threads will also obtain 0 value.
>
> Step 1: (calling another function load_cache_entries_threaded with
> nr_threads as an argument )  [ link:
> https://github.com/git/git/blob/311531c9de557d25ac087c1637818bd2aad6eb3a/read-cache.c#L2247
> ]
>       src_offset += load_cache_entries_threaded(istate, mmap,
> mmap_size, nr_threads, ieot);

Hmm, this function call is guarded by an `if (ieot)` block:

	if (ieot) {
		src_offset += load_cache_entries_threaded(istate, mmap, mmap_size, nr_threads, ieot);
		free(ieot);
	} else {
		src_offset += load_all_cache_entries(istate, mmap, mmap_size, src_offset);
	}


And `ieot` will only get a non-NULL value if this previous assignment was
executed:

	if (extension_offset && nr_threads > 1)
		ieot = read_ieot_extension(mmap, mmap_size, extension_offset);

So it seems to me that we only call `load_cache_entries_threaded()` when
`nr_threads > 1`.

> Step 2:  (use nr_threads as divisor, leading to possible divide by
> zero in function load_cache_entries_threaded) [ link:
> https://github.com/git/git/blob/311531c9de557d25ac087c1637818bd2aad6eb3a/read-cache.c#L2103
> ]
>       ieot_blocks = DIV_ROUND_UP(ieot->nr, nr_threads);