Attempt 2 - Fix Missing Git Executable Causing ClusterFuzz Crash by DaveLak · Pull Request #1909 · gitpython-developers/GitPython

@DaveLak

This is a second attempt at gitpython-developers#1906 and should resolve:
- gitpython-developers#1905
- google/oss-fuzz#10600

PR gitpython-developers#1906 had the right idea but wrong implementation, and the differences between
the ClusterFuzz image that it was supposed to fix and the OSS-Fuzz image where
the fix was tested led to the issue not being fully resolved.

The root cause of the issue is the same: A Git executable is not globally
available in the ClusterFuzz container environment where OSS-Fuzz executes
fuzz tests.

 gitpython-developers#1906 attempted to fix the issue by bundling the Git binary and using
GitPython's `git.refresh(<full-path-to-git-executable>)` method to set it
inside the `TestOneInput` function of the test harness.

However, GitPython attempts to set the binary at import time via its `__init__`
hook, and crashes the test if no executable is found during the import.

This issue is fixed here by setting the environment variable that GitPython
looks in before importing it, so it's available for the import. This was tested
by setting the `$PATH` to an empty string inside the test files, which
reproduced the crash, then adding the changes introduced here with `$PATH` still
empty, which avoided the crash indicating that the bundled Git executable is
working as expected.

@DaveLak mentioned this pull request

Apr 26, 2024

1 task

@DaveLak DaveLak deleted the attempt-two-fuzzing-fix-missing-git-in-clusterfuzz branch

April 27, 2024 14:48

DaveLak added a commit to DaveLak/GitPython that referenced this pull request

Jun 4, 2024
ClusterFuzz runs of the `fuzz_submodule` target have been failing
because the `git` import was placed before the condition that sets the
Git executable path.

The order in which `git` is imported matters because it attempts to find
a Git executable as the import is loaded (via `refresh()` in
`git/__init__.py`.) As per gitpython-developers#1909, we configure the ClusterFuzz
environment to use a bundled Git executable via the env variable
condition in all fuzz targets.