Attempt 2 - Fix Missing Git Executable Causing ClusterFuzz Crash · gitpython-developers/GitPython@dac3535 · GitHub

1. gitpython-developers
2. GitPython

Repository navigation

• Code
• Issues6 (6)
• Pull requests8 (8)
• Discussions
• Actions
• Security and quality42 (42)
• Insights

Commit dac3535

Browse filesBrowse the repository at this point in the historyBrowse files

DaveLak

committed

Attempt 2 - Fix Missing Git Executable Causing ClusterFuzz Crash

This is a second attempt at #1906 and should resolve: - #1905 - google/oss-fuzz#10600 PR #1906 had the right idea but wrong implementation, and the differences between the ClusterFuzz image that it was supposed to fix and the OSS-Fuzz image where the fix was tested led to the issue not being fully resolved. The root cause of the issue is the same: A Git executable is not globally available in the ClusterFuzz container environment where OSS-Fuzz executes fuzz tests. #1906 attempted to fix the issue by bundling the Git binary and using GitPython's `git.refresh(<full-path-to-git-executable>)` method to set it inside the `TestOneInput` function of the test harness. However, GitPython attempts to set the binary at import time via its `__init__` hook, and crashes the test if no executable is found during the import. This issue is fixed here by setting the environment variable that GitPython looks in before importing it, so it's available for the import. This was tested by setting the `$PATH` to an empty string inside the test files, which reproduced the crash, then adding the changes introduced here with `$PATH` still empty, which avoided the crash indicating that the bundled Git executable is working as expected.

1 parent 82bb3bb commit dac3535
Copy full SHA for dac3535

2 files changed

+8-8Lines changed: 8 additions & 8 deletions

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

• fuzzing/fuzz-targets
  • fuzz_config.py
  • fuzz_tree.py

Expand file treeCollapse file tree

Open diff view settings

Collapse file

‎fuzzing/fuzz-targets/fuzz_config.py‎

Copy file name to clipboardExpand all lines: fuzzing/fuzz-targets/fuzz_config.py

+4-4Lines changed: 4 additions & 4 deletions

Original file line number	Diff line number	Diff line change
@@ -23,15 +23,15 @@
23	23	import os
24	24	from configparser import MissingSectionHeaderError, ParsingError
25	25
	26	+ if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"):
	27	+ path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git"))
	28	+ os.environ["GIT_PYTHON_GIT_EXECUTABLE"] = path_to_bundled_git_binary
	29	+
26	30	with atheris.instrument_imports():
27	31	import git
28	32
29	33
30	34	def TestOneInput(data):
31		- if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"):
32		- path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git"))
33		- git.refresh(path_to_bundled_git_binary)
34		-
35	35	sio = io.BytesIO(data)
36	36	sio.name = "/tmp/fuzzconfig.config"
37	37	git_config = git.GitConfigParser(sio)

Collapse file

‎fuzzing/fuzz-targets/fuzz_tree.py‎

Copy file name to clipboardExpand all lines: fuzzing/fuzz-targets/fuzz_tree.py

+4-4Lines changed: 4 additions & 4 deletions

Original file line number	Diff line number	Diff line change
@@ -23,15 +23,15 @@
23	23	import os
24	24	import shutil
25	25
	26	+ if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"):
	27	+ path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git"))
	28	+ os.environ["GIT_PYTHON_GIT_EXECUTABLE"] = path_to_bundled_git_binary
	29	+
26	30	with atheris.instrument_imports():
27	31	import git
28	32
29	33
30	34	def TestOneInput(data):
31		- if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"):
32		- path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git"))
33		- git.refresh(path_to_bundled_git_binary)
34		-
35	35	fdp = atheris.FuzzedDataProvider(data)
36	36	git_dir = "/tmp/.git"
37	37	head_file = os.path.join(git_dir, "HEAD")

0 commit comments

Comments

0 (0)