[PATCH] Segfault when committing renamed file with changed svn:eol-style property

When changing the svn:eol-style property of a renamed (but not
committed) file, svn from trunk and 1.1.x segfaults on commit. The
following script reproduces the segfault:

======== CUT {{{ ========
#!/bin/bash

# Change this to the svn executable to run
svn=svn

mkdir wc repos 2>/dev/null
[ -d "repos/." ] || { echo "Repository parent dir not found" >&2; exit 1; }
[ -d "wc/." ] || { echo "wc parent dir not found" >&2; exit 1; }
subrepos=test.$(date +"%H_%M_%S")
repos=$(/bin/pwd)/repos/$subrepos
$svn --version | head -2
echo === Creating repository in "$repos"...
svnadmin create $repos
cd wc || { echo "cd wc: Error" >&2; exit 1; }
echo === Checking out empty wc...
$svn co file://$repos $subrepos
echo === cd $subrepos
cd $subrepos || { echo "cd $subrepos: Error" >&2; exit 1; }
echo blurfl >file1
$svn add file1
$svn ci -m "Adding file1"
echo === $svn up
$svn up
echo === $svn mv file1 file2
$svn mv file1 file2
echo === $svn ps svn:eol-style native file2
$svn ps svn:eol-style native file2
echo === Commit file2
$svn ci -m "Commit file2"
echo === $svn up
$svn up
======== }}} CUT ========

This segfault has been around on trunk and 1.1.x since it was introduced
in r8984. svn does not segfault on the 1.0.x branch, as r8984 was never
merged into that branch.

This is what happens when running the script against svn from
trunk@r10614:

======== CUT {{{ ========
$ ./fail.sh
svn, version 1.2.0 (trunk@r10614)
   compiled Aug 13 2004, 08:47:45
=== Creating repository in /home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/repos/test.11_07_56...
=== Checking out empty wc...
Checked out revision 0.
=== cd test.11_07_56
A file1
Adding file1
Transmitting file data .
Committed revision 1.
=== svn-trunk up
At revision 1.
=== svn-trunk mv file1 file2
A file2
D file1
=== svn-trunk ps svn:eol-style native file2
property 'svn:eol-style' set on 'file2'
=== Commit file2
./fail.sh: line 27: 30327 Segmentation fault $svn ci -m "Commit file2"
=== svn-trunk up
subversion/libsvn_wc/lock.c:157: (apr_err=155004)
svn: Working copy '.' locked
svn: run 'svn cleanup' to remove locks (type 'svn help cleanup' for details)
$
======== }}} CUT ========

A gdb backtrace shows this:

======== CUT {{{ ========
Starting program: /usr/local/bin/svn-trunk ci
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 31464)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 31464)]
0x4049c894 in strcmp () from /lib/libc.so.6
#0 0x4049c894 in strcmp () from /lib/libc.so.6
#1 0x0808c5e3 in compare_and_verify (modified_p=0xbfffefcc,
    versioned_file=0x8187010 "/home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/wc/test.11_11_08/file2", adm_access=0x8184558,
    base_file=0x818d810 "/home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/wc/test.11_11_08/.svn/text-base/file2.svn-base", pool=0x818d3e0)
    at subversion/libsvn_wc/questions.c:344
#2 0x0808c806 in svn_wc_text_modified_p (modified_p=0xbfffefcc,
    filename=0x8187010 "/home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/wc/test.11_11_08/file2", force_comparison=1, adm_access=0x8184558,
    pool=0x8186fb8) at subversion/libsvn_wc/questions.c:422
#3 0x0805f48f in harvest_committables (committables=0x8189fa8,
    path=0x8187010 "/home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/wc/test.11_11_08/file2", adm_access=0x8184558,
    url=0x8189698 "file:///home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/repos/test.11_11_08/file2", copyfrom_url=0x0, entry=0x8189470,
    parent_entry=0x8184b60, adds_only=0, copy_mode=0, nonrecursive=0, ctx=0x814c5e0,
    pool=0x8186fb8) at subversion/libsvn_client/commit_util.c:385
#4 0x0805f86a in harvest_committables (committables=0x8189fa8,
    path=0x8184fe8 "/home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/wc/test.11_11_08", adm_access=0x8184558,
    url=0x8184a00 "file:///home/sunny/src/svn/test/branches/r8984-fix_til_svn-lista/svnbugs/rename+propset/repos/test.11_11_08", copyfrom_url=0x0, entry=0x8184b60, parent_entry=0x0,
    adds_only=0, copy_mode=0, nonrecursive=0, ctx=0x814c5e0, pool=0x8184fb0)
    at subversion/libsvn_client/commit_util.c:523
#5 0x0805fd52 in svn_client__harvest_committables (committables=0xbffff1cc,
    parent_dir=0x8184558, targets=0x817b7e0, nonrecursive=0, ctx=0x814c5e0, pool=0x814c060)
    at subversion/libsvn_client/commit_util.c:672
#6 0x0805e588 in svn_client_commit (commit_info=0xbffff240, targets=0x8177320,
    nonrecursive=0, ctx=0x814c5e0, pool=0x814c060) at subversion/libsvn_client/commit.c:1274
#7 0x0804db5b in svn_cl__commit (os=0x814c098, baton=0xbffff310, pool=0x814c060)
    at subversion/clients/cmdline/commit-cmd.c:94
#8 0x0805266b in main (argc=2, argv=0xbffff554) at subversion/clients/cmdline/main.c:1327
======== }}} CUT ========

The segfault happens when running a strcmp() in compare_and_verify() because
entry->checksum has turned into a null pointer after a call to
apr_hash_get() in subversion/libsvn_wc/entries.c:727 .

The following patch removes the segfault:

[[[
Remove segfault introduced in r8984 when committing a renamed file with
modified svn:eol-style property.

* subversion/libsvn_wc/questions.c
  (compare_and_verify): Add null pointer check to entry->checksum before
    using it with strcmp().
]]]

Index: subversion/libsvn_wc/questions.c
===================================================================
--- subversion/libsvn_wc/questions.c (revision 10615)
+++ subversion/libsvn_wc/questions.c (working copy)
@@ -341,7 +341,7 @@
     apr_md5_final (digest, &context);
 
     checksum = svn_md5_digest_to_cstring (digest, pool);
- if (strcmp (checksum, entry->checksum) != 0)
+ if (entry->checksum && (strcmp (checksum, entry->checksum) != 0))
       {
         return svn_error_createf
           (SVN_ERR_WC_CORRUPT_TEXT_BASE, NULL,

http://www.sunbase.org/src/subversion/patch/r10615-commit_segfault.patch
15ce1f60f7f5f406b2f4648c02333ceb r10615-commit_segfault.patch

-- 
Regards,
Øyvind A. Holm
---------------------
#!/bin/bash
for f in 1 2 3; do
  PREF=http://musthave.sunbase.org/Stallman/stallman${f}c
  wget $PREF.sub ; mplayer -cache 8192 -sub stallman${f}c.sub $PREF.mpeg
done
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org