From dac3535d3dc4aaff9bd98a6ea70f46b132537694 Mon Sep 17 00:00:00 2001 From: David Lakin Date: Fri, 26 Apr 2024 18:13:11 -0400 Subject: [PATCH] Attempt 2 - Fix Missing Git Executable Causing ClusterFuzz Crash This is a second attempt at #1906 and should resolve: - https://github.com/gitpython-developers/GitPython/issues/1905 - https://github.com/google/oss-fuzz/issues/10600 PR #1906 had the right idea but wrong implementation, and the differences between the ClusterFuzz image that it was supposed to fix and the OSS-Fuzz image where the fix was tested led to the issue not being fully resolved. The root cause of the issue is the same: A Git executable is not globally available in the ClusterFuzz container environment where OSS-Fuzz executes fuzz tests. #1906 attempted to fix the issue by bundling the Git binary and using GitPython's `git.refresh()` method to set it inside the `TestOneInput` function of the test harness. However, GitPython attempts to set the binary at import time via its `__init__` hook, and crashes the test if no executable is found during the import. This issue is fixed here by setting the environment variable that GitPython looks in before importing it, so it's available for the import. This was tested by setting the `$PATH` to an empty string inside the test files, which reproduced the crash, then adding the changes introduced here with `$PATH` still empty, which avoided the crash indicating that the bundled Git executable is working as expected. --- fuzzing/fuzz-targets/fuzz_config.py | 8 ++++---- fuzzing/fuzz-targets/fuzz_tree.py | 8 ++++---- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/fuzzing/fuzz-targets/fuzz_config.py b/fuzzing/fuzz-targets/fuzz_config.py index 6f2caad4b..4eddc32ff 100644 --- a/fuzzing/fuzz-targets/fuzz_config.py +++ b/fuzzing/fuzz-targets/fuzz_config.py @@ -23,15 +23,15 @@ import os from configparser import MissingSectionHeaderError, ParsingError +if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"): + path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git")) + os.environ["GIT_PYTHON_GIT_EXECUTABLE"] = path_to_bundled_git_binary + with atheris.instrument_imports(): import git def TestOneInput(data): - if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"): - path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git")) - git.refresh(path_to_bundled_git_binary) - sio = io.BytesIO(data) sio.name = "/tmp/fuzzconfig.config" git_config = git.GitConfigParser(sio) diff --git a/fuzzing/fuzz-targets/fuzz_tree.py b/fuzzing/fuzz-targets/fuzz_tree.py index 7187c4a6f..4e2038add 100644 --- a/fuzzing/fuzz-targets/fuzz_tree.py +++ b/fuzzing/fuzz-targets/fuzz_tree.py @@ -23,15 +23,15 @@ import os import shutil +if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"): + path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git")) + os.environ["GIT_PYTHON_GIT_EXECUTABLE"] = path_to_bundled_git_binary + with atheris.instrument_imports(): import git def TestOneInput(data): - if getattr(sys, "frozen", False) and hasattr(sys, "_MEIPASS"): - path_to_bundled_git_binary = os.path.abspath(os.path.join(os.path.dirname(__file__), "git")) - git.refresh(path_to_bundled_git_binary) - fdp = atheris.FuzzedDataProvider(data) git_dir = "/tmp/.git" head_file = os.path.join(git_dir, "HEAD")