ports/123369: devel/git crashes with use-after-free in git-fetch

[Coleman Kane]

>Number:         123369
>Category:       ports
>Synopsis:       devel/git crashes with use-after-free in git-fetch
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat May 03 16:00:07 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Coleman Kane
>Release:        FreeBSD 8.0-CURRENT amd64
>Organization:
FreeBSD
>Environment:
FreeBSD erwin 8.0-CURRENT FreeBSD 8.0-CURRENT #0: Mon Apr 28 20:01:08 EDT
2008     root at erwin:/usr/obj/usr/src/sys/ERWIN  amd64
>Description:
	When using git-fetch (or via git-pull), the program git-fetch crashes
with a Bus Error. I tracked it down to the following GDB trace:

(gdb) bt
#0  0x0000000800e65103 in malloc_usable_size () from /lib/libc.so.7
#1  0x0000000800e65727 in free () from /lib/libc.so.7
#2  0x00000000004adff3 in transport_unlock_pack (transport=0x70f080)
    at transport.c:811
#3  0x00000000004241ac in unlock_pack () at builtin-fetch.c:56
#4  0x0000000800eb65a9 in __cxa_finalize () from /lib/libc.so.7
#5  0x0000000800e69567 in exit () from /lib/libc.so.7
#6  0x0000000000404bf4 in handle_internal_command (argc=2,
argv=0x7fffffffe5b8)
    at git.c:379
#7  0x0000000000404cb9 in main (argc=2, argv=0x7fffffffe5b8) at git.c:414

It seems that transport_unlock_pack is trying to re-free the argument being
passed to free().

>How-To-Repeat:
   1) Install the latest devel/git.
   2) Try using git-fetch or git-pull to update a git.
>Fix:
   The fix has already hit the git tree (but was not in 1.5.5.1):
http://repo.or.cz/w/git.git?a=commit;h=7b7f39eae6ab0bbcc68d3c42a5b23595880e528f

>Release-Note:
>Audit-Trail:
>Unformatted: