{"action":"closed","issue":{"url":"https://api.github.com/repos/libgit2/libgit2/issues/2940","labels_url":"https://api.github.com/repos/libgit2/libgit2/issues/2940/labels{/name}","comments_url":"https://api.github.com/repos/libgit2/libgit2/issues/2940/comments","events_url":"https://api.github.com/repos/libgit2/libgit2/issues/2940/events","html_url":"https://github.com/libgit2/libgit2/issues/2940","id":59659700,"number":2940,"title":"apply_credentials segmentation fault","user":{"login":"mattyclarkson","id":1081113,"avatar_url":"https://avatars.githubusercontent.com/u/1081113?v=3","gravatar_id":"","url":"https://api.github.com/users/mattyclarkson","html_url":"https://github.com/mattyclarkson","followers_url":"https://api.github.com/users/mattyclarkson/followers","following_url":"https://api.github.com/users/mattyclarkson/following{/other_user}","gists_url":"https://api.github.com/users/mattyclarkson/gists{/gist_id}","starred_url":"https://api.github.com/users/mattyclarkson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattyclarkson/subscriptions","organizations_url":"https://api.github.com/users/mattyclarkson/orgs","repos_url":"https://api.github.com/users/mattyclarkson/repos","events_url":"https://api.github.com/users/mattyclarkson/events{/privacy}","received_events_url":"https://api.github.com/users/mattyclarkson/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-03-03T15:42:59Z","updated_at":"2015-03-04T00:30:37Z","closed_at":"2015-03-04T00:30:37Z","body":"I was implementing a wrapper around `git_remote_push` in the `nodegit` bindings. I was ending up with a segmentation fault:\r\n\r\n```\r\n=================================================================\r\n==32409==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x7f9272172631 sp 0x7f92705597d0 bp 0x7f9270559870 T3)\r\n    #0 0x7f9272172630 in apply_credentials ../vendor/libgit2/src/transports/http.c:181\r\n    #1 0x7f9272172900 in gen_request ../vendor/libgit2/src/transports/http.c:209\r\n    #2 0x7f9272175491 in http_stream_read ../vendor/libgit2/src/transports/http.c:603\r\n    #3 0x7f927217b852 in git_smart__recv_cb ../vendor/libgit2/src/transports/smart.c:24\r\n    #4 0x7f92721b8346 in gitno_recv ../vendor/libgit2/src/netops.c:21\r\n    #5 0x7f9272181733 in git_smart__store_refs ../vendor/libgit2/src/transports/smart_protocol.c:54\r\n    #6 0x7f927217c836 in git_smart__connect ../vendor/libgit2/src/transports/smart.c:173\r\n    #7 0x7f92721123fb in git_remote_connect ../vendor/libgit2/src/remote.c:735\r\n    #8 0x7f927211afc2 in git_remote_push ../vendor/libgit2/src/remote.c:2396\r\n    #9 0x7f9271f83cde in GitRemote::PushWorker::Execute() ../src/remote.cc:1749\r\n    #10 0x7f9271e43f9c in NanAsyncExecute(uv_work_s*) ../node_modules/nan/nan.h:1676\r\n    #11 0x84732c (/usr/bin/node+0x84732c)\r\n    #12 0x83c7d7 (/usr/bin/node+0x83c7d7)\r\n    #13 0x7f9275ce3373 in start_thread (/usr/lib/libpthread.so.0+0x7373)\r\n    #14 0x7f9275a2127c in clone (/usr/lib/libc.so.6+0xe827c)\r\n```\r\n\r\nIt was occuring because I'd provided an SSH credentials object in the credentials callback when trying to push to a HTTPS remote.\r\n\r\nThe cause was that `apply_credentials` has a situation when it can dereference `context` when it has been set to `0` by `auth_context_match`.\r\n\r\nThe offending line is [here](https://github.com/libgit2/libgit2/blob/20273e4d3cf2554fb6d209474400105ca15e92b5/src/transports/http.c#L181). The [line](https://github.com/libgit2/libgit2/blob/20273e4d3cf2554fb6d209474400105ca15e92b5/src/transports/http.c#L178) few bits above that is `auth_context_match`. `auth_context_match` can [exit](https://github.com/libgit2/libgit2/blob/20273e4d3cf2554fb6d209474400105ca15e92b5/src/transports/http.c#L135) with a [successful](https://github.com/libgit2/libgit2/blob/20273e4d3cf2554fb6d209474400105ca15e92b5/src/transports/http.c#L149) `0` status code resulting in `context` becoming `null`, [here](https://github.com/libgit2/libgit2/blob/20273e4d3cf2554fb6d209474400105ca15e92b5/src/transports/http.c#L125).\r\n\r\nThis results in the `context->next_token` dereferencing a null pointer."}}