Skip to content

git-remote-https.exe NULL dereference when sh is missing from PATH #6411

Description

@xsquat

Existing issues matching what you're seeing

  • I was not able to find an open or closed issue matching what I'm seeing

Git for Windows version

2.55.0.windows.3

Windows version

Windows 10

Windows CPU architecture

x86_64 (64-bit)

Additional Windows version information

WindowsVersion: 2009
OS Build: 26200
OS Architecture: 64-bit

Options set during installation

Default options / no intentionally customized installation options

Other interesting things

The crash occurs when Git is launched from a restricted/sandboxed Windows account.

The process PATH in the captured crash dump does not include the Git directories containing sh.exe (Git\bin / Git\usr\bin), although sh.exe is installed with Git for Windows.

The same repository/network workflow works from a normal Windows/Git Bash environment where sh.exe is discoverable.

The issue was reproduced multiple times and one controlled reproduction was captured with Microsoft Sysinternals ProcDump 12.01.

Exception:
0xC0000005 ACCESS_VIOLATION (read)

Fault location:
git-remote-https.exe + 0xa45fc

Faulting instruction:
movzx edx, byte ptr [rax]

At the fault:
rax = 0

The stack remains inside git-remote-https.exe until kernel32/ntdll. No faulting frame was identified in libcurl, OpenSSL or Git Credential Manager.

Dump/disassembly analysis points to the run-command path while preparing a shell command. Git appears to search for the literal "sh"; in this restricted PATH the lookup returns NULL, after which the result appears to be dereferenced without a NULL check.

A full ProcDump (~52 MB) is retained locally and can be provided privately if maintainers need additional debugger/register/module information. I have not attached it publicly because a process dump may contain environment or process data.

Terminal/shell

Other — Git invoked from a restricted/sandboxed Windows process environment. The same operation succeeds from the normal Windows/Git Bash environment.

Commands that trigger the issue

git push -u origin <branch>
An HTTPS Git operation from the restricted environment reliably starts git-remote-https.exe and reproduces the crash.

The relevant difference is that the restricted process PATH does not contain the Git directories where sh.exe is installed.

I am intentionally not providing the private repository or branch name because they do not appear relevant to the reproduction.

Expected behaviour

If Git cannot locate sh.exe, it should fail gracefully with a clear error message and a non-zero exit code. It should not crash.

Actual behaviour

git-remote-https.exe crashes with an unhandled read access violation:

0xC0000005 ACCESS_VIOLATION
git-remote-https.exe + 0xa45fc
movzx edx, byte ptr [rax]
rax = 0

A controlled reproduction captured the crash with ProcDump.

Analysis indicates that the restricted PATH prevents Git from locating sh.exe. The lookup appears to return NULL and that result is subsequently dereferenced.

Repository

No response

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions