[PR #4962] [MERGED] Fix null pointer dereference in ParseCommitWithSignature #17569

New Issue

GiteaMirror · 2025-11-02T14:07:29-06:00

GiteaMirror commented

2025-11-02 14:07:29 -06:00

📋 Pull Request Information

Original PR: https://github.com/go-gitea/gitea/pull/4962
Author: @SagePtr
Created: 9/19/2018
Status: ✅ Merged
Merged: 9/20/2018
Merged by: @lunny

Base: master ← Head: issue4961

📝 Commits (1)

4a23de2 Fix null pointer dereference in ParseCommitWithSignature

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 models/gpg_key.go (+1 -1)

📄 Description

Fixes #4961

Explanation: tag commits do not have 'author' and 'committer', they have 'tagger' field (which is treated as 'author' in vendor/code.gitea.io/git/repo_commit.go:68) and committer is simply nil.

But ParseCommitWithSignature thinked if signature is set - then committer is set too. So now it just skips checking signature if no committer is set.

Probably repo_commit.go from vendor git module should set 'tagger' to both 'author' and 'committer' fields, I have no idea what behaviour is correct (addressed here: go-gitea/git#129 )

Or maybe ParseCommitWithSignature should check signature against both Author and Committer and return true if any one of them is correct.

Now I just check against null pointer to solve panic issue.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/go-gitea/gitea/pull/4962 **Author:** [@SagePtr](https://github.com/SagePtr) **Created:** 9/19/2018 **Status:** ✅ Merged **Merged:** 9/20/2018 **Merged by:** [@lunny](https://github.com/lunny) **Base:** `master` ← **Head:** `issue4961` --- ### 📝 Commits (1) - [`4a23de2`](https://github.com/go-gitea/gitea/commit/4a23de27df6efcd938ba23d61e1a31c5efb79ced) Fix null pointer dereference in ParseCommitWithSignature ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `models/gpg_key.go` (+1 -1) </details> ### 📄 Description Fixes #4961 Explanation: tag commits do not have 'author' and 'committer', they have 'tagger' field (which is treated as 'author' in vendor/code.gitea.io/git/repo_commit.go:68) and committer is simply nil. But ParseCommitWithSignature thinked if signature is set - then committer is set too. So now it just skips checking signature if no committer is set. Probably repo_commit.go from vendor git module should set 'tagger' to both 'author' and 'committer' fields, I have no idea what behaviour is correct (addressed here: go-gitea/git#129 ) Or maybe ParseCommitWithSignature should check signature against both Author and Committer and return true if any one of them is correct. Now I just check against null pointer to solve panic issue. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2025-11-02 14:07:29 -06:00

GiteaMirror closed this issue

2025-11-02 14:07:34 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#17569