kmx git

Commit	Date	Message
24b8dd82	2018-07-27T12:31:32	ci: move travis to the new scripts
465f8b51	2018-07-26T15:14:37	ci: move appveyor to new scripts
6fb63c92	2018-07-26T14:29:41	ci: use docker containers from libgit2 account
f7bb4ff8	2018-07-26T15:06:01	ci: use a single setup script for mingw
dc6e80e2	2018-07-26T14:04:19	ci: perform clang builds on Linux
b00672b9	2018-07-20T19:47:40	ci: enable leak checking on osx
afecd15c	2018-07-20T18:09:38	ci: msvc leak-checking
7f12c123	2018-07-20T17:20:15	ci: xcode leaks leak-checking
219512e7	2018-07-20T14:14:16	buf tests: allocate a smaller size for the oom On Linux (where we run valgrind) allocate a smaller buffer, but still an insanely large size. This will cause malloc to fail but will not cause valgrind to report a likely error with a negative-sized malloc. Keep the original buffer size on non-Linux platforms: this is well-tested on them and changing it may be problematic. On macOS, for example, using the new size causes `malloc` to print a warning to stderr.
6eb97b6b	2018-07-25T01:04:55	ci: dissociate test from leaks process The leaks process is not good about handling children. Ensure that its child is `nohup`ed so that the grandparent shell won't wait for it to exit.
6d6700d2	2018-07-20T19:01:55	ci: valgrind leak-checking
230eeda8	2018-07-21T10:49:23	ci: some additional debugging
67f5304f	2018-07-14T12:42:50	ci: introduce vsts builds
9e588060	2018-07-14T13:03:16	ci: scripts to setup mingw build environment
87342404	2018-07-14T12:35:02	ci: set up a macos host Script to set up dependencies on a macOS build system.
5bb2087b	2018-07-14T12:34:05	ci: setup a linux host Sets up a linux host to prepare for a build.
451b0017	2018-07-14T12:25:32	ci: improved flexibility for citest.sh Refactor citest.sh to enable local testing by developers.
bf418f09	2018-07-14T12:24:40	ci: refactor unix ci build/test scripts
e2cc5b6d	2018-07-14T12:22:47	ci: move tests into citest.ps1 Add citest.ps1 PowerShell script to run the tests.
3b6281fa	2018-07-14T12:22:16	ci: Windows PowerShell build script
ce798b25	2018-07-04T10:56:56	tests: simplify cmake test configuration Simplify the names for the tests, removing the unnecessary "libgit2-clar" prefix. Make "all" the new default test run, and include the online tests by default (since HTTPS should always be enabled). For the CI tests, create an offline-only test, then the various online tests.
7d3930a1	2018-07-26T11:15:23	Merge pull request #4739 from pks-t/pks/mbedtls-unused-variable mbedtls: remove unused variable "cacert"
d4198d4d	2018-07-26T12:11:34	mbedtls: remove unused variable "cacert" In commit 382ed1e87 (mbedtls: load default CA certificates, 2018-03-29), the function `git_mbedtls_stream_global_init` was refactored to call out to `git_mbedtls__set_cert_location` instead of setting up the certificates itself. The conversion forgot to remove the now-unused "cacert" variable, which is now only getting declared to be free'd at the end of the function. Remove it.
45a78977	2018-07-23T12:38:40	Merge pull request #4732 from libgit2/ethomson/leaks Squash some leaks
2fabb622	2018-07-21T01:36:46	mbedtls: free stream on shutdown
9e002cd5	2018-07-21T01:11:58	mbedtls: make ciphers_list a static array Instead of allocating the ciphers_list, make it a static array. This prevents us from leaking it or having to manage its memory.
4e62d26f	2018-07-21T00:45:24	mbedtls: free ciphers_list
defa9709	2018-07-21T00:41:38	mbedtls: check allocations
d285de73	2018-07-20T21:52:24	push tests: deeply free the specs Don't just free the spec vector, also free the specs themselves.
dad99881	2018-07-20T21:51:36	push tests: deeply free the push status Don't just free the push status structure, actually free the strings that were strdup'd into the struct as well.
ca2eb460	2018-07-20T21:50:58	smart subtransport: free url when resetting stream Free the url field when resetting the stream to avoid leaking it.
ea9e2c1a	2018-07-20T13:06:56	Merge pull request #4692 from tiennou/examples/checkout Add a checkout example
0652abaa	2018-07-20T12:56:49	Merge pull request #4702 from tiennou/fix/coverity Assorted Coverity fixes
fa401a32	2018-07-19T08:20:04	Merge pull request #4704 from nelhage/no-pkt-pack Remove GIT_PKT_PACK entirely
b24202e1	2018-07-07T12:52:24	examples: add checkout
99bb98c0	2018-07-16T11:18:13	Merge pull request #4722 from boogisha/path-is-ignored-git-analogy ignore: improve `git_ignore_path_is_ignored` description Git analogy
ee3baed1	2018-07-15T19:28:22	Merge pull request #4724 from libgit2/cmn/allocator-init-order alloc: don't overwrite allocator during init if set
388149f5	2018-07-15T17:25:26	No need for this placeholder.
19007b19	2018-07-15T17:30:04	alloc: don't overwrite allocator during init if set If the allocator has been set before we the library is initialised, we would replace that setting with the standard allocator contrary to the user's wishes.
2510268a	2018-07-14T14:00:26	Merge pull request #4700 from pks-t/pks/std-c90 C90 standard compliance
9cab93c0	2018-07-13T21:29:01	ignore: improve `git_ignore_path_is_ignored` description Git analogy In attempt to provide adequate Git command analogy in regards to ignored files handling, `git_ignore_path_is_ignored` description mentions doing `git add .` on directory containing the file, and whether the file in question would be added or not - but behavior of the two matches for untracked files only, making the comparison misleading in general sense. For tracked files, Git doesn't subject them to ignore rules, so even if a rule applies, `git add .` would actually add the tracked file changes to index, while `git_ignore_path_is_ignored` would still consider the file being ignored (as it doesn't check the index, as documented). Let's provide `git check-ignore --no-index` as analogous Git command example instead, being more aligned with what `git_ignore_path_is_ignored` is about, no matter if the file in question is already tracked or not. See issue #4720 (git_ignore_path_is_ignored documentation misleading?, 2018-07-10)[1] for additional information. [1] https://github.com/libgit2/libgit2/issues/4720
e1a4a8eb	2018-06-25T11:58:34	cmake: enforce C90 standard While the aim of libgit2 was to conform to C90 code, we never instructed the compiler to enforce C90 compliance. Thus, quite a few violations were able to get into our code base, which have been removed with the previous commits. As we are now able to build libgit2 with C90 enforced, we can set the C_STANDARD property for our own build targets. Note that we explicitly avoid setting the C standard for our third-party dependencies. At least the zlib target does not build with C90 enforced, and we do not want to fix them by deviating from upstream. Thus we simply enforce no standard for them.
d19381e2	2018-06-25T14:57:07	mbedtls: fix `inline` being used in mbedtls headers The mbedtls headers make direct use of the `inline` attribute to instruct the compiler to inline functions. As this function is not C90 compliant, this can cause the compiler to error as soon as any of these files is included and the `-std=c90` flag is being added. The mbedtls headers declaring functions as inline always have a prelude which define `inline` as a macro in case it is not yet defined. Thus, we can easily replace their define with our own define, which simply copies the logic of our own `GIT_INLINE` macro.
c13e56f9	2018-06-25T14:12:53	cmake: distinguish internal and system include directories While we want to enforce strict C90 mode, this may cause issues with system provided header files which are themselves not strictly conforming. E.g. if a system header has C++ style comments, a compiler in strict C90 mode would produce an error and abort the build. As the user most likely doesn't want to change the system header, this would completely break the build on such systems. One example of this is mbedtls, which provides such header files. The problem can be worked around by distinguishing between system-provided and project-provided include directories. When adding include directories via "-isystem" instead of "-I", the compiler will skip certain checks and print out less warnings. To use system includes, we can simply add the "SYSTEM" flag to CMake's `INCLUDE_DIRECTORIES` and `TARGET_INCLUDE_DIRECTORIES` functions. Note that we have to split the include directories into two variables because of this, as we definitely still want to check for all warnings produced by our own header files.
9994cd3f	2018-06-25T11:56:52	treewide: remove use of C++ style comments C++ style comment ("//") are not specified by the ISO C90 standard and thus do not conform to it. While libgit2 aims to conform to C90, we did not enforce it until now, which is why quite a lot of these non-conforming comments have snuck into our codebase. Do a tree-wide conversion of all C++ style comments to the supported C style comments to allow us enforcing strict C90 compliance in a later commit.
f347a441	2018-06-25T11:55:13	treewide: avoid use of `inline` attribute ISO C90 does not specify the `inline` attribute, and as such we cannot use it in our code. While we already use `__inline` when building in Microsoft Visual Studio, we should also be using the `__inline__` attribute from GCC/Clang. Otherwise, if we're using neither MSVC nor GCC/Clang, we should simply avoid using `inline` at all and just define functions as static. This commit adjusts our own `GIT_INLINE` macro as well as the inline macros specified by khash and xdiff. This allows us to enable strict C90 mode in a later commit.
6dfc8bc2	2018-07-09T23:10:05	Merge pull request #4719 from pks-t/pks/delta-oob Delta OOB access
290292b4	2018-07-08T15:28:50	Merge pull request #4710 from pks-t/pks/ssl-init-errors streams: report OpenSSL errors if global init fails
5b7ba786	2018-06-23T15:45:04	examples: add a helper for boolean-style options
8e063eb6	2018-06-23T15:44:35	examples: make the refish resolution work with short OIDs
8a629afe	2018-01-31T00:02:00	examples: move refish resolution function in common
698b4463	2018-06-23T13:06:10	annotated_commit: make the refname accessible As git_annotated_commit seems to behave like cgit's refish, it's quite helpful to abstract away "targets" via git_annotated_commit_from_id/from_ref. As the former is accessible via git_annotated_commit_id, make the latter also available to users.
89091d36	2018-07-06T20:24:21	tests: fix a relative pathname issue The path given to `git_index_add_bypath` is relative to the root of the repository. That `describe/file` path is relative to the root of the sandbox directory, hence if I add the missing `cl_git_pass` I rightfully get an error that `$SANDBOX/describe/describe/file doesn't exist`. The path is thus changed to be made relative to the repository, which makes the failure go away and "restore" the test.
8455a270	2018-07-01T12:04:27	tests: add missing cl_git_pass to tests Reported by Coverity, CID 1393678-1393697.
6ae6491e	2018-07-06T22:24:16	smart: don't dereference a NULL pkt pointer By clarifying what detect_caps returns on empty/missing packet, we can be sure there are actually refs to process. The old code could blindly dereference `first`, which might have been NULL. Reported by Coverity, CID 1393614
68c7480a	2018-07-06T20:21:25	smart: clarify error handling in git_smart__connect
36a5b557	2018-06-19T20:18:26	submodule: don't leak memory when failing to insert the names Reported by Coverity, CID 1393237
17bd3b96	2018-06-19T20:15:49	tests: mailmap/parsing: add a missing cl_git_pass Reported by Coverity, CID 1393483
ca9bbcb5	2018-06-19T20:15:02	blame: check error code when loading the mailmap Reported by Coverity, CID 1393484
f4633791	2018-07-06T12:36:05	Merge pull request #4687 from tiennou/fix/4672 patch_parse: populate line numbers while parsing diffs
f2a1cece	2018-07-06T11:25:47	Merge pull request #4686 from tiennou/fix/more-worktree-from-bare Fix git_worktree_validate failing on bare repositories
8a00de08	2018-07-06T10:47:06	Merge pull request #4699 from nelhage/fetch-null-dst git_refspec_transform: Handle NULL dst
75395c87	2018-06-29T13:35:14	streams: report OpenSSL errors if global init fails In case when the global initialization of the OpenSSL stream fails, the user is left without any hint as to what went wrong as we do not provide any error message at all. This commit refactors the init function to have a common error path, which now also sets an error message including the error string provided by OpenSSL.
e087c0de	2018-07-05T13:30:46	delta: fix overflow when computing limit When checking whether a delta base offset and length fit into the base we have in memory already, we can trigger an overflow which breaks the check. This would subsequently result in us reading memory from out of bounds of the base. The issue is easily fixed by checking for overflow when adding `off` and `len`, thus guaranteeting that we are never indexing beyond `base_len`. This corresponds to the git patch 8960844a7 (check patch_delta bounds more carefully, 2006-04-07), which adds these overflow checks. Reported-by: Riccardo Schirone <rschiron@redhat.com>
c43658f6	2018-06-30T13:24:23	Merge pull request #4536 from libgit2/ethomson/index_dirty Add a "dirty" state to the index when it has unsaved changes
a73b7c2f	2018-06-29T16:54:06	This error case is now unneeded
b8408557	2018-06-29T16:53:23	Merge remote-tracking branch 'origin/master' into no-pkt-pack
ff8edac9	2018-06-29T16:18:36	formatting fix
243d40df	2018-06-22T19:21:22	docs: add unsaved index safety to changelog
bfa1f022	2018-06-22T19:17:08	settings: optional unsaved index safety Add the `GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY` option, which will cause commands that reload the on-disk index to fail if the current `git_index` has changed that have not been saved. This will prevent users from - for example - adding a file to the index then calling a function like `git_checkout` and having that file be silently removed from the index since it was re-read from disk. Now calls that would re-read the index will fail if the index is "dirty", meaning changes have been made to it but have not been written. Users can either `git_index_read` to discard those changes explicitly, or `git_index_write` to write them.
787768c2	2018-06-22T19:07:54	index: return a unique error code on dirty index When the index is dirty, return GIT_EINDEXDIRTY so that consumers can identify the exact problem programatically.
5e26391a	2018-06-18T18:28:08	checkout: FORCE doesn't halt on dirty index If the index is dirty, allow `GIT_CHECKOUT_FORCE` to obliterate unsaved changes. This is in keeping with its name and description.
b242cdbf	2017-11-17T00:19:07	index: commit the changes to the index properly Now that the index has a "dirty" state, where it has changes that have not yet been committed or rolled back, our tests need to be adapted to actually commit or rollback the changes instead of assuming that the index can be operated on in its indeterminate state.
dc4a18c7	2017-11-12T08:23:13	index: test dirty index bit Test that any changes to the index will mark the index as dirty. Also ensure that when we initialize a new index, read the index contents from disk, or write the index contents to disk that we reset the dirty flag to zero. Further ensure that an unforced read with dirty contents (when the on-disk index has not changed) does _not_ reset the dirty flag as we have not updated the contents of our index and our unsaved contents remain intact.
7c56c49b	2017-11-12T08:09:35	index: add a dirty bit reflecting unsaved changes Teach the index when it is "dirty", and has unsaved changes. Consider the index dirty whenever a caller has added or removed an entry from the main index, REUC or NAME section, including when the index is completely cleared. Similarly, consider the index _not_ dirty immediately after it is written, or when it is read from the on-disk index. This allows us to ensure that unsaved changes are not lost when we automatically refresh the index.
4919e495	2018-02-18T23:55:56	stash: use _an_ index not _the_ index Don't manipulate the repository's index during stash; instead, manipulate a temporary index and check it out. This allows us to use the checkout mechanism to update the workdir and the repository's index, and allows checkout to use its common mechanisms to write data and handle errors.
55a96606	2018-06-18T16:14:26	checkout tests: validate GIT_CHECKOUT_NO_REFRESH Add tests that ensure that we re-read the on-disk image by default during checkout, but when the `GIT_CHECKOUT_NO_REFRESH` option is specified, we do _not_ re-read the index.
1da6329f	2018-06-29T14:39:17	worktree: don't return "untyped" negative numbers as error codes
292a6eca	2018-06-29T14:39:16	worktree: skip building a buffer when validating
8356bf7e	2018-06-29T14:39:14	tests: worktree/bare: test some paths
d0921127	2018-06-29T14:39:13	tests: add a helper to build sandbox subpaths quickly
83c35f7e	2018-06-29T14:39:11	tests: worktree/bare: fix git_worktree_validate
bd40f0d7	2018-06-29T14:39:10	tests: worktree/bare: check git_worktree_list
7e3c13e0	2018-06-29T14:39:08	tests: worktree/bare: gather all tests
68e73791	2018-06-29T12:52:35	Merge pull request #4709 from pks-t/pks/refspec-dispose refspec: rename `git_refspec__free` to `git_refspec__dispose`
01574d40	2018-06-29T11:28:17	Merge pull request #4701 from nikital/master streams: openssl: Handle error in SSL_CTX_new
af3088e4	2018-06-29T11:45:15	refspec: rename `git_refspec__free` to `git_refspec__dispose` Since commit 630a67366 (refspec: add public parsing api, 2018-02-07), we now have two functions `git_refspec_free` and `git_refspec__free`. The difference is that the first one will free the structure itself, while the second one will only free the structure's contents. Use our new `dispose` naming pattern for the latter function to help avoid confusion.
7192e26f	2018-06-29T09:43:33	Merge pull request #4519 from cynecx/refspec-parsing refspec: add public parsing api
24597812	2018-06-29T09:11:02	delta: fix out-of-bounds read of delta When computing the offset and length of the delta base, we repeatedly increment the `delta` pointer without checking whether we have advanced past its end already, which can thus result in an out-of-bounds read. Fix this by repeatedly checking whether we have reached the end. Add a test which would cause Valgrind to produce an error. Reported-by: Riccardo Schirone <rschiron@redhat.com> Test-provided-by: Riccardo Schirone <rschiron@redhat.com>
7db25870	2018-06-29T07:45:18	delta: fix sign-extension of big left-shift Our delta code was originally adapted from JGit, which itself adapted it from git itself. Due to this heritage, we inherited a bug from git.git in how we compute the delta offset, which was fixed upstream in 48fb7deb5 (Fix big left-shifts of unsigned char, 2009-06-17). As explained by Linus: Shifting 'unsigned char' or 'unsigned short' left can result in sign extension errors, since the C integer promotion rules means that the unsigned char/short will get implicitly promoted to a signed 'int' due to the shift (or due to other operations). This normally doesn't matter, but if you shift things up sufficiently, it will now set the sign bit in 'int', and a subsequent cast to a bigger type (eg 'long' or 'unsigned long') will now sign-extend the value despite the original expression being unsigned. One example of this would be something like unsigned long size; unsigned char c; size += c << 24; where despite all the variables being unsigned, 'c << 24' ends up being a signed entity, and will get sign-extended when then doing the addition in an 'unsigned long' type. Since git uses 'unsigned char' pointers extensively, we actually have this bug in a couple of places. In our delta code, we inherited such a bogus shift when computing the offset at which the delta base is to be found. Due to the sign extension we can end up with an offset where all the bits are set. This can allow an arbitrary memory read, as the addition in `base_len < off + len` can now overflow if `off` has all its bits set. Fix the issue by casting the result of `*delta++ << 24UL` to an unsigned integer again. Add a test with a crafted delta that would actually succeed with an out-of-bounds read in case where the cast wouldn't exist. Reported-by: Riccardo Schirone <rschiron@redhat.com> Test-provided-by: Riccardo Schirone <rschiron@redhat.com>
895a668e	2018-06-28T05:27:36	Small style tweak, and set an error
967da2c7	2018-06-27T17:30:12	Merge pull request #4688 from mystor/sorted_revwalk_reset Fix interaction between limited flag and sorting over resets
0d1d9e1e	2018-06-27T17:28:40	Merge pull request #4691 from pks-t/pks/http-parser-fallthrough deps: fix implicit fallthrough warning in http-parser
12232a5e	2018-06-27T17:19:37	Merge pull request #4698 from nelhage/fix-leaks Fix assorted leaks found via fuzzing
88b30f51	2017-11-12T20:50:00	checkout: always set the index in checkout data Always set the `index` in the `checkout_data`, even in the case that we are not reloading the index. Other functionality in checkout examines the index (for example: determining whether the workdir is modified) and we need it even in the (uncommon) case that we are not reloading.
7330ae67	2018-06-26T10:45:57	index::addall tests: write the index When running `git_index_add_all`, we should write the index to disk so that we can re-read it safely during status.
5dd34702	2018-06-26T09:56:43	Merge branch 'nelhage/smart-no-pack'
9286e413	2018-06-26T09:56:06	smart protocol: correct error message capitalization
08ea0d7d	2018-02-18T11:49:08	index::reuc tests: test that checkout succeeds The index::reuc tests must test that the checkout itself succeeds, otherwise subsequent tests are not valid. In fact, the checkouts were failing because when checking out `SAFE`, they cannot update the files that are in conflict. Change the checkout level to `FORCE` to ensure that they get updated correctly.
c4ce017f	2018-02-18T22:27:34	index::names tests: add conflicts with high stages We add entries into the main index to correspond with the NAME entries that we're going to test. NAME entries store the results of conflicts occuring with rename detection during merge, and they must correspond to conflicts in the index. This test was mistakenly adding regular entries. The checkout validation failed, since it requires NAME entries to correspond to high-stage (conflict) entries. Correct the test to actually create conflicts.

24b8dd82

2018-07-27T12:31:32

ci: move travis to the new scripts

465f8b51

2018-07-26T15:14:37

ci: move appveyor to new scripts

6fb63c92

2018-07-26T14:29:41

ci: use docker containers from libgit2 account

f7bb4ff8

2018-07-26T15:06:01

ci: use a single setup script for mingw

dc6e80e2

2018-07-26T14:04:19

ci: perform clang builds on Linux

b00672b9

2018-07-20T19:47:40

ci: enable leak checking on osx

afecd15c

2018-07-20T18:09:38

ci: msvc leak-checking

7f12c123

2018-07-20T17:20:15

ci: xcode leaks leak-checking

219512e7

2018-07-20T14:14:16

buf tests: allocate a smaller size for the oom On Linux (where we run valgrind) allocate a smaller buffer, but still an insanely large size. This will cause malloc to fail but will not cause valgrind to report a likely error with a negative-sized malloc. Keep the original buffer size on non-Linux platforms: this is well-tested on them and changing it may be problematic. On macOS, for example, using the new size causes `malloc` to print a warning to stderr.

6eb97b6b

2018-07-25T01:04:55

ci: dissociate test from leaks process The leaks process is not good about handling children. Ensure that its child is `nohup`ed so that the grandparent shell won't wait for it to exit.

6d6700d2

2018-07-20T19:01:55

ci: valgrind leak-checking

230eeda8

2018-07-21T10:49:23

ci: some additional debugging

67f5304f

2018-07-14T12:42:50

ci: introduce vsts builds

9e588060

2018-07-14T13:03:16

ci: scripts to setup mingw build environment

87342404

2018-07-14T12:35:02

ci: set up a macos host Script to set up dependencies on a macOS build system.

5bb2087b

2018-07-14T12:34:05

ci: setup a linux host Sets up a linux host to prepare for a build.

451b0017

2018-07-14T12:25:32

ci: improved flexibility for citest.sh Refactor citest.sh to enable local testing by developers.

bf418f09

2018-07-14T12:24:40

ci: refactor unix ci build/test scripts

e2cc5b6d

2018-07-14T12:22:47

ci: move tests into citest.ps1 Add citest.ps1 PowerShell script to run the tests.

3b6281fa

2018-07-14T12:22:16

ci: Windows PowerShell build script

ce798b25

2018-07-04T10:56:56

tests: simplify cmake test configuration Simplify the names for the tests, removing the unnecessary "libgit2-clar" prefix. Make "all" the new default test run, and include the online tests by default (since HTTPS should always be enabled). For the CI tests, create an offline-only test, then the various online tests.

7d3930a1

2018-07-26T11:15:23

Merge pull request #4739 from pks-t/pks/mbedtls-unused-variable mbedtls: remove unused variable "cacert"

d4198d4d

2018-07-26T12:11:34

mbedtls: remove unused variable "cacert" In commit 382ed1e87 (mbedtls: load default CA certificates, 2018-03-29), the function `git_mbedtls_stream_global_init` was refactored to call out to `git_mbedtls__set_cert_location` instead of setting up the certificates itself. The conversion forgot to remove the now-unused "cacert" variable, which is now only getting declared to be free'd at the end of the function. Remove it.

45a78977

2018-07-23T12:38:40

Merge pull request #4732 from libgit2/ethomson/leaks Squash some leaks

2fabb622

2018-07-21T01:36:46

mbedtls: free stream on shutdown

9e002cd5

2018-07-21T01:11:58

mbedtls: make ciphers_list a static array Instead of allocating the ciphers_list, make it a static array. This prevents us from leaking it or having to manage its memory.

4e62d26f

2018-07-21T00:45:24

mbedtls: free ciphers_list

defa9709

2018-07-21T00:41:38

mbedtls: check allocations

d285de73

2018-07-20T21:52:24

push tests: deeply free the specs Don't just free the spec vector, also free the specs themselves.

dad99881

2018-07-20T21:51:36

push tests: deeply free the push status Don't just free the push status structure, actually free the strings that were strdup'd into the struct as well.

ca2eb460

2018-07-20T21:50:58

smart subtransport: free url when resetting stream Free the url field when resetting the stream to avoid leaking it.

ea9e2c1a

2018-07-20T13:06:56

Merge pull request #4692 from tiennou/examples/checkout Add a checkout example

0652abaa

2018-07-20T12:56:49

Merge pull request #4702 from tiennou/fix/coverity Assorted Coverity fixes

fa401a32

2018-07-19T08:20:04

Merge pull request #4704 from nelhage/no-pkt-pack Remove GIT_PKT_PACK entirely

b24202e1

2018-07-07T12:52:24

examples: add checkout

99bb98c0

2018-07-16T11:18:13

Merge pull request #4722 from boogisha/path-is-ignored-git-analogy ignore: improve `git_ignore_path_is_ignored` description Git analogy

ee3baed1

2018-07-15T19:28:22

Merge pull request #4724 from libgit2/cmn/allocator-init-order alloc: don't overwrite allocator during init if set

388149f5

2018-07-15T17:25:26

No need for this placeholder.

19007b19

2018-07-15T17:30:04

alloc: don't overwrite allocator during init if set If the allocator has been set before we the library is initialised, we would replace that setting with the standard allocator contrary to the user's wishes.

2510268a

2018-07-14T14:00:26

Merge pull request #4700 from pks-t/pks/std-c90 C90 standard compliance

9cab93c0

2018-07-13T21:29:01

ignore: improve `git_ignore_path_is_ignored` description Git analogy In attempt to provide adequate Git command analogy in regards to ignored files handling, `git_ignore_path_is_ignored` description mentions doing `git add .` on directory containing the file, and whether the file in question would be added or not - but behavior of the two matches for untracked files only, making the comparison misleading in general sense. For tracked files, Git doesn't subject them to ignore rules, so even if a rule applies, `git add .` would actually add the tracked file changes to index, while `git_ignore_path_is_ignored` would still consider the file being ignored (as it doesn't check the index, as documented). Let's provide `git check-ignore --no-index` as analogous Git command example instead, being more aligned with what `git_ignore_path_is_ignored` is about, no matter if the file in question is already tracked or not. See issue #4720 (git_ignore_path_is_ignored documentation misleading?, 2018-07-10)[1] for additional information. [1] https://github.com/libgit2/libgit2/issues/4720

e1a4a8eb

2018-06-25T11:58:34

cmake: enforce C90 standard While the aim of libgit2 was to conform to C90 code, we never instructed the compiler to enforce C90 compliance. Thus, quite a few violations were able to get into our code base, which have been removed with the previous commits. As we are now able to build libgit2 with C90 enforced, we can set the C_STANDARD property for our own build targets. Note that we explicitly avoid setting the C standard for our third-party dependencies. At least the zlib target does not build with C90 enforced, and we do not want to fix them by deviating from upstream. Thus we simply enforce no standard for them.

d19381e2

2018-06-25T14:57:07

mbedtls: fix `inline` being used in mbedtls headers The mbedtls headers make direct use of the `inline` attribute to instruct the compiler to inline functions. As this function is not C90 compliant, this can cause the compiler to error as soon as any of these files is included and the `-std=c90` flag is being added. The mbedtls headers declaring functions as inline always have a prelude which define `inline` as a macro in case it is not yet defined. Thus, we can easily replace their define with our own define, which simply copies the logic of our own `GIT_INLINE` macro.

c13e56f9

2018-06-25T14:12:53

cmake: distinguish internal and system include directories While we want to enforce strict C90 mode, this may cause issues with system provided header files which are themselves not strictly conforming. E.g. if a system header has C++ style comments, a compiler in strict C90 mode would produce an error and abort the build. As the user most likely doesn't want to change the system header, this would completely break the build on such systems. One example of this is mbedtls, which provides such header files. The problem can be worked around by distinguishing between system-provided and project-provided include directories. When adding include directories via "-isystem" instead of "-I", the compiler will skip certain checks and print out less warnings. To use system includes, we can simply add the "SYSTEM" flag to CMake's `INCLUDE_DIRECTORIES` and `TARGET_INCLUDE_DIRECTORIES` functions. Note that we have to split the include directories into two variables because of this, as we definitely still want to check for all warnings produced by our own header files.

9994cd3f

2018-06-25T11:56:52

treewide: remove use of C++ style comments C++ style comment ("//") are not specified by the ISO C90 standard and thus do not conform to it. While libgit2 aims to conform to C90, we did not enforce it until now, which is why quite a lot of these non-conforming comments have snuck into our codebase. Do a tree-wide conversion of all C++ style comments to the supported C style comments to allow us enforcing strict C90 compliance in a later commit.

f347a441

2018-06-25T11:55:13

treewide: avoid use of `inline` attribute ISO C90 does not specify the `inline` attribute, and as such we cannot use it in our code. While we already use `__inline` when building in Microsoft Visual Studio, we should also be using the `__inline__` attribute from GCC/Clang. Otherwise, if we're using neither MSVC nor GCC/Clang, we should simply avoid using `inline` at all and just define functions as static. This commit adjusts our own `GIT_INLINE` macro as well as the inline macros specified by khash and xdiff. This allows us to enable strict C90 mode in a later commit.

6dfc8bc2

2018-07-09T23:10:05

Merge pull request #4719 from pks-t/pks/delta-oob Delta OOB access

290292b4

2018-07-08T15:28:50

Merge pull request #4710 from pks-t/pks/ssl-init-errors streams: report OpenSSL errors if global init fails

5b7ba786

2018-06-23T15:45:04

examples: add a helper for boolean-style options

8e063eb6

2018-06-23T15:44:35

examples: make the refish resolution work with short OIDs

8a629afe

2018-01-31T00:02:00

examples: move refish resolution function in common

698b4463

2018-06-23T13:06:10

annotated_commit: make the refname accessible As git_annotated_commit seems to behave like cgit's refish, it's quite helpful to abstract away "targets" via git_annotated_commit_from_id/from_ref. As the former is accessible via git_annotated_commit_id, make the latter also available to users.

89091d36

2018-07-06T20:24:21

tests: fix a relative pathname issue The path given to `git_index_add_bypath` is relative to the root of the repository. That `describe/file` path is relative to the root of the sandbox directory, hence if I add the missing `cl_git_pass` I rightfully get an error that `$SANDBOX/describe/describe/file doesn't exist`. The path is thus changed to be made relative to the repository, which makes the failure go away and "restore" the test.

8455a270

2018-07-01T12:04:27

tests: add missing cl_git_pass to tests Reported by Coverity, CID 1393678-1393697.

6ae6491e

2018-07-06T22:24:16

smart: don't dereference a NULL pkt pointer By clarifying what detect_caps returns on empty/missing packet, we can be sure there are actually refs to process. The old code could blindly dereference `first`, which might have been NULL. Reported by Coverity, CID 1393614

68c7480a

2018-07-06T20:21:25

smart: clarify error handling in git_smart__connect

36a5b557

2018-06-19T20:18:26

submodule: don't leak memory when failing to insert the names Reported by Coverity, CID 1393237

17bd3b96

2018-06-19T20:15:49

tests: mailmap/parsing: add a missing cl_git_pass Reported by Coverity, CID 1393483

ca9bbcb5

2018-06-19T20:15:02

blame: check error code when loading the mailmap Reported by Coverity, CID 1393484

f4633791

2018-07-06T12:36:05

Merge pull request #4687 from tiennou/fix/4672 patch_parse: populate line numbers while parsing diffs

f2a1cece

2018-07-06T11:25:47

Merge pull request #4686 from tiennou/fix/more-worktree-from-bare Fix git_worktree_validate failing on bare repositories

8a00de08

2018-07-06T10:47:06

Merge pull request #4699 from nelhage/fetch-null-dst git_refspec_transform: Handle NULL dst

75395c87

2018-06-29T13:35:14

streams: report OpenSSL errors if global init fails In case when the global initialization of the OpenSSL stream fails, the user is left without any hint as to what went wrong as we do not provide any error message at all. This commit refactors the init function to have a common error path, which now also sets an error message including the error string provided by OpenSSL.

e087c0de

2018-07-05T13:30:46

delta: fix overflow when computing limit When checking whether a delta base offset and length fit into the base we have in memory already, we can trigger an overflow which breaks the check. This would subsequently result in us reading memory from out of bounds of the base. The issue is easily fixed by checking for overflow when adding `off` and `len`, thus guaranteeting that we are never indexing beyond `base_len`. This corresponds to the git patch 8960844a7 (check patch_delta bounds more carefully, 2006-04-07), which adds these overflow checks. Reported-by: Riccardo Schirone <rschiron@redhat.com>

c43658f6

2018-06-30T13:24:23

Merge pull request #4536 from libgit2/ethomson/index_dirty Add a "dirty" state to the index when it has unsaved changes

a73b7c2f

2018-06-29T16:54:06

This error case is now unneeded

b8408557

2018-06-29T16:53:23

Merge remote-tracking branch 'origin/master' into no-pkt-pack

ff8edac9

2018-06-29T16:18:36

formatting fix

243d40df

2018-06-22T19:21:22

docs: add unsaved index safety to changelog

bfa1f022

2018-06-22T19:17:08

settings: optional unsaved index safety Add the `GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY` option, which will cause commands that reload the on-disk index to fail if the current `git_index` has changed that have not been saved. This will prevent users from - for example - adding a file to the index then calling a function like `git_checkout` and having that file be silently removed from the index since it was re-read from disk. Now calls that would re-read the index will fail if the index is "dirty", meaning changes have been made to it but have not been written. Users can either `git_index_read` to discard those changes explicitly, or `git_index_write` to write them.

787768c2

2018-06-22T19:07:54

index: return a unique error code on dirty index When the index is dirty, return GIT_EINDEXDIRTY so that consumers can identify the exact problem programatically.

5e26391a

2018-06-18T18:28:08

checkout: FORCE doesn't halt on dirty index If the index is dirty, allow `GIT_CHECKOUT_FORCE` to obliterate unsaved changes. This is in keeping with its name and description.

b242cdbf

2017-11-17T00:19:07

index: commit the changes to the index properly Now that the index has a "dirty" state, where it has changes that have not yet been committed or rolled back, our tests need to be adapted to actually commit or rollback the changes instead of assuming that the index can be operated on in its indeterminate state.

dc4a18c7

2017-11-12T08:23:13

index: test dirty index bit Test that any changes to the index will mark the index as dirty. Also ensure that when we initialize a new index, read the index contents from disk, or write the index contents to disk that we reset the dirty flag to zero. Further ensure that an unforced read with dirty contents (when the on-disk index has not changed) does _not_ reset the dirty flag as we have not updated the contents of our index and our unsaved contents remain intact.

7c56c49b

2017-11-12T08:09:35

index: add a dirty bit reflecting unsaved changes Teach the index when it is "dirty", and has unsaved changes. Consider the index dirty whenever a caller has added or removed an entry from the main index, REUC or NAME section, including when the index is completely cleared. Similarly, consider the index _not_ dirty immediately after it is written, or when it is read from the on-disk index. This allows us to ensure that unsaved changes are not lost when we automatically refresh the index.

4919e495

2018-02-18T23:55:56

stash: use _an_ index not _the_ index Don't manipulate the repository's index during stash; instead, manipulate a temporary index and check it out. This allows us to use the checkout mechanism to update the workdir and the repository's index, and allows checkout to use its common mechanisms to write data and handle errors.

55a96606

2018-06-18T16:14:26

checkout tests: validate GIT_CHECKOUT_NO_REFRESH Add tests that ensure that we re-read the on-disk image by default during checkout, but when the `GIT_CHECKOUT_NO_REFRESH` option is specified, we do _not_ re-read the index.

1da6329f

2018-06-29T14:39:17

worktree: don't return "untyped" negative numbers as error codes

292a6eca

2018-06-29T14:39:16

worktree: skip building a buffer when validating

8356bf7e

2018-06-29T14:39:14

tests: worktree/bare: test some paths

d0921127

2018-06-29T14:39:13

tests: add a helper to build sandbox subpaths quickly

83c35f7e

2018-06-29T14:39:11

tests: worktree/bare: fix git_worktree_validate

bd40f0d7

2018-06-29T14:39:10

tests: worktree/bare: check git_worktree_list

7e3c13e0

2018-06-29T14:39:08

tests: worktree/bare: gather all tests

68e73791

2018-06-29T12:52:35

Merge pull request #4709 from pks-t/pks/refspec-dispose refspec: rename `git_refspec__free` to `git_refspec__dispose`

01574d40

2018-06-29T11:28:17

Merge pull request #4701 from nikital/master streams: openssl: Handle error in SSL_CTX_new

af3088e4

2018-06-29T11:45:15

refspec: rename `git_refspec__free` to `git_refspec__dispose` Since commit 630a67366 (refspec: add public parsing api, 2018-02-07), we now have two functions `git_refspec_free` and `git_refspec__free`. The difference is that the first one will free the structure itself, while the second one will only free the structure's contents. Use our new `dispose` naming pattern for the latter function to help avoid confusion.

7192e26f

2018-06-29T09:43:33

Merge pull request #4519 from cynecx/refspec-parsing refspec: add public parsing api

24597812

2018-06-29T09:11:02

delta: fix out-of-bounds read of delta When computing the offset and length of the delta base, we repeatedly increment the `delta` pointer without checking whether we have advanced past its end already, which can thus result in an out-of-bounds read. Fix this by repeatedly checking whether we have reached the end. Add a test which would cause Valgrind to produce an error. Reported-by: Riccardo Schirone <rschiron@redhat.com> Test-provided-by: Riccardo Schirone <rschiron@redhat.com>

7db25870

2018-06-29T07:45:18

delta: fix sign-extension of big left-shift Our delta code was originally adapted from JGit, which itself adapted it from git itself. Due to this heritage, we inherited a bug from git.git in how we compute the delta offset, which was fixed upstream in 48fb7deb5 (Fix big left-shifts of unsigned char, 2009-06-17). As explained by Linus: Shifting 'unsigned char' or 'unsigned short' left can result in sign extension errors, since the C integer promotion rules means that the unsigned char/short will get implicitly promoted to a signed 'int' due to the shift (or due to other operations). This normally doesn't matter, but if you shift things up sufficiently, it will now set the sign bit in 'int', and a subsequent cast to a bigger type (eg 'long' or 'unsigned long') will now sign-extend the value despite the original expression being unsigned. One example of this would be something like unsigned long size; unsigned char c; size += c << 24; where despite all the variables being unsigned, 'c << 24' ends up being a signed entity, and will get sign-extended when then doing the addition in an 'unsigned long' type. Since git uses 'unsigned char' pointers extensively, we actually have this bug in a couple of places. In our delta code, we inherited such a bogus shift when computing the offset at which the delta base is to be found. Due to the sign extension we can end up with an offset where all the bits are set. This can allow an arbitrary memory read, as the addition in `base_len < off + len` can now overflow if `off` has all its bits set. Fix the issue by casting the result of `*delta++ << 24UL` to an unsigned integer again. Add a test with a crafted delta that would actually succeed with an out-of-bounds read in case where the cast wouldn't exist. Reported-by: Riccardo Schirone <rschiron@redhat.com> Test-provided-by: Riccardo Schirone <rschiron@redhat.com>

895a668e

2018-06-28T05:27:36

Small style tweak, and set an error

967da2c7

2018-06-27T17:30:12

Merge pull request #4688 from mystor/sorted_revwalk_reset Fix interaction between limited flag and sorting over resets

0d1d9e1e

2018-06-27T17:28:40

Merge pull request #4691 from pks-t/pks/http-parser-fallthrough deps: fix implicit fallthrough warning in http-parser

12232a5e

2018-06-27T17:19:37

Merge pull request #4698 from nelhage/fix-leaks Fix assorted leaks found via fuzzing

88b30f51

2017-11-12T20:50:00

checkout: always set the index in checkout data Always set the `index` in the `checkout_data`, even in the case that we are not reloading the index. Other functionality in checkout examines the index (for example: determining whether the workdir is modified) and we need it even in the (uncommon) case that we are not reloading.

7330ae67

2018-06-26T10:45:57

index::addall tests: write the index When running `git_index_add_all`, we should write the index to disk so that we can re-read it safely during status.

5dd34702

2018-06-26T09:56:43

Merge branch 'nelhage/smart-no-pack'

9286e413

2018-06-26T09:56:06

smart protocol: correct error message capitalization

08ea0d7d

2018-02-18T11:49:08

index::reuc tests: test that checkout succeeds The index::reuc tests must test that the checkout itself succeeds, otherwise subsequent tests are not valid. In fact, the checkouts were failing because when checking out `SAFE`, they cannot update the files that are in conflict. Change the checkout level to `FORCE` to ensure that they get updated correctly.

c4ce017f

2018-02-18T22:27:34

index::names tests: add conflicts with high stages We add entries into the main index to correspond with the NAME entries that we're going to test. NAME entries store the results of conflicts occuring with rename detection during merge, and they must correspond to conflicts in the index. This test was mistakenly adding regular entries. The checkout validation failed, since it requires NAME entries to correspond to high-stage (conflict) entries. Correct the test to actually create conflicts.

thodg/libgit2

Log