Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-59252

git-forensics plugin doesn't guard against negative line numbers

XMLWordPrintable

    • git-forensics 0.3.2

      With

      • warnings-ng 6.0.0
      • git-forensics 0.3.1

      I saw a branch build of a repository - just a regular branch, not even a PR - produce this stack trace:

      java.lang.ArrayIndexOutOfBoundsException: -1
       at org.eclipse.jgit.blame.BlameResult.getSourceAuthor(BlameResult.java:191)
       at io.jenkins.plugins.git.forensics.blame.GitBlamer$BlameCallback.run(GitBlamer.java:181)
       at io.jenkins.plugins.git.forensics.blame.GitBlamer$BlameCallback.invoke(GitBlamer.java:142)
       at io.jenkins.plugins.git.forensics.blame.GitBlamer$BlameCallback.invoke(GitBlamer.java:120)
       at org.jenkinsci.plugins.gitclient.AbstractGitAPIImpl.withRepository(AbstractGitAPIImpl.java:29)
       at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.withRepository(CliGitAPIImpl.java:72)
       at io.jenkins.plugins.git.forensics.blame.GitBlamer.blame(GitBlamer.java:92)
       at io.jenkins.plugins.analysis.core.steps.IssuesScanner$ReportPostProcessor.invoke(IssuesScanner.java:253)
       at io.jenkins.plugins.analysis.core.steps.IssuesScanner$ReportPostProcessor.invoke(IssuesScanner.java:216)
       at hudson.FilePath$FileCallableWrapper.call(FilePath.java:3050)
       at hudson.remoting.UserRequest.perform(UserRequest.java:212)
       at hudson.remoting.UserRequest.perform(UserRequest.java:54)
       at hudson.remoting.Request$2.run(Request.java:369)
       at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
       at java.util.concurrent.FutureTask.run(FutureTask.java:266)
       at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
       at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
       at hudson.remoting.Engine$1.lambda$newThread$0(Engine.java:93)
       at java.lang.Thread.run(Thread.java:748)
      Finished: FAILURE
      

      The line in question in git-forensics is here: https://github.com/jenkinsci/git-forensics-plugin/blob/master/src/main/java/io/jenkins/plugins/git/forensics/blame/GitBlamer.java#L181

      It looks like for some reason line was 0, and therefore lineIndex became -1, which upset JGit when it tried to use that as an array index to get blame: https://github.com/eclipse/jgit/blob/master/org.eclipse.jgit/src/org/eclipse/jgit/blame/BlameResult.java#L190

      The more I look at this the more this looks like a logic error from GitBlamer's PoV - there's nothing that I can see in FileLocations that programmatically ensures a line number can't be 0, nor does GitBlamer check for this - but then it subtracts 1 from a lineNumber and uses that in JGit code that eventually becomes an index for array access.

      Created this issue per Ullrich Hafner's request on the warnings-ng Gitter chat:

      This is a bug, I forget to add the guard from GitBlamer in the new version. Can you please create a bug report?

            drulli Ulli Hafner
            awitt Austin
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: