[BUG]: slice bounds out of range at modules/git #9205

New Issue

GiteaMirror · 2025-11-02T08:32:11-06:00

GiteaMirror commented

2025-11-02 08:32:11 -06:00

Originally created by @secsys-go on GitHub (Jul 11, 2022).

Description

I tried to parse some data with ParseTreeEntries in modules/git, but it crashed instead of returning an error

package main
import "code.gitea.io/gitea/modules/git"
func main() {
	git.ParseTreeEntries([]byte("1006440000000000000000000000000000000000000000000000000000000000000000000000\t\n1006440000000000000000000000000000000000000000000000000000000000000000000000\t\n1006440000000000000000000000000000000000000000000000000000000000000000000000\t\n1006440000000000000000000000000000000000000000000000"))
}

Found by go-fuzz

Gitea Version

with git commit as ee769f7459

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

Ubuntu

How are you running Gitea?

I test the API in Gitea through go-fuzz

Database

No response

Originally created by @secsys-go on GitHub (Jul 11, 2022). ### Description I tried to parse some data with ParseTreeEntries in modules/git, but it crashed instead of returning an error ```go package main import "code.gitea.io/gitea/modules/git" func main() { git.ParseTreeEntries([]byte("1006440000000000000000000000000000000000000000000000000000000000000000000000\t\n1006440000000000000000000000000000000000000000000000000000000000000000000000\t\n1006440000000000000000000000000000000000000000000000000000000000000000000000\t\n1006440000000000000000000000000000000000000000000000")) } ``` Found by [go-fuzz](https://github.com/dvyukov/go-fuzz) ### Gitea Version with git commit as ee769f7459ffba310563cd735f503d3d7576da60 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System Ubuntu ### How are you running Gitea? I test the API in Gitea through go-fuzz ### Database _No response_

GiteaMirror added the type/bug label 2025-11-02 08:32:11 -06:00

GiteaMirror closed this issue

2025-11-02 08:32:11 -06:00

GiteaMirror commented

2025-11-02 08:32:11 -06:00

@lunny commented on GitHub (Jul 11, 2022):

So I assume you are using SHA256 but not SHA1 ?

@lunny commented on GitHub (Jul 11, 2022): So I assume you are using SHA256 but not SHA1 ?

GiteaMirror commented

2025-11-02 08:32:12 -06:00

@wxiaoguang commented on GitHub (Jul 11, 2022):

So I assume you are using SHA256 but not SHA1 ?

Since that's generated by a fuzz test, it doesn't need to be SHA256 or SHA1.

@wxiaoguang commented on GitHub (Jul 11, 2022): > So I assume you are using SHA256 but not SHA1 ? Since that's generated by a fuzz test, it doesn't need to be SHA256 or SHA1.

GiteaMirror commented

2025-11-02 08:32:12 -06:00

@Gusted commented on GitHub (Jul 11, 2022):

Fuzzing Gitea directly by calling it's function is risky and IMO incorrect, because you want to make sure that fuzz-data go trough all stages as a normal workflow would, so just fuzzing a specific function in modules/ is useless as there's a good chance that before that function is called within Gitea it already did go trough other checks, not all validation and sanity checks live in modules/ but can also lives at go-chi level or in the routers/ level. Well they do present an interesting case, unless it's actually "actionable" it isn't worth adding checks when they may already exist.

I had a quick look at the function and there are two references, one is for testing and the other reference is a helper function for parsing the raw stdout of git commands. Unless git decides to change this output or somehow be able to corrupt the output this panic cannot ever exist.

@Gusted commented on GitHub (Jul 11, 2022): Fuzzing Gitea directly by calling it's function is risky and IMO incorrect, because you want to make sure that fuzz-data go trough all stages as a normal workflow would, so just fuzzing a specific function in `modules/` is useless as there's a good chance that before that function is called within Gitea it already did go trough other checks, not all validation and sanity checks live in `modules/` but can also lives at go-chi level or in the `routers/` level. Well they do present an interesting case, unless it's actually "actionable" it isn't worth adding checks when they may already exist. ---- I had a quick look at the function and there are two references, one is for testing and the [other reference](https://github.com/go-gitea/gitea/blob/cb6c5f8193946cf65ba9b325a1989d72faaf2b86/modules/indexer/code/git.go#L72) is a helper function for parsing the raw stdout of git commands. Unless git decides to change this output or somehow be able to corrupt the output this panic cannot ever exist.

GiteaMirror commented

2025-11-02 08:32:12 -06:00

@wxiaoguang commented on GitHub (Oct 7, 2022):

-> Refactor parseTreeEntries, speed up tree list #21368

The minimal reproducible case is:

package main

import "code.gitea.io/gitea/modules/git"

func main() {
	// "runtime error: slice bounds out of range"
	ParseTreeEntries([]byte("100644 blob ea0d83c9081af9500ac9f804101b3fd0a5c293af"))
}

@wxiaoguang commented on GitHub (Oct 7, 2022): -> Refactor parseTreeEntries, speed up tree list #21368 The minimal reproducible case is: ```go package main import "code.gitea.io/gitea/modules/git" func main() { // "runtime error: slice bounds out of range" ParseTreeEntries([]byte("100644 blob ea0d83c9081af9500ac9f804101b3fd0a5c293af")) } ```

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9205