Log

Author Commit Date CI Message
Edward Thomson 2e8c3b0b 2020-01-18T17:17:46 oid functions: return an int Stop returning a void for functions, future-proofing them to allow them to fail.
Edward Thomson 9893d376 2020-01-18T15:41:20 git_attr_cache_flush: return an int Stop returning a void for functions, future-proofing them to allow them to fail.
Edward Thomson 4460bf40 2020-01-24T11:08:44 Merge pull request #5286 from libgit2/ethomson/gssapi HTTP: Support Apache-based servers with Negotiate
Edward Thomson e9cef7c4 2020-01-11T23:53:45 http: introduce GIT_ERROR_HTTP Disambiguate between general network problems and HTTP problems in error codes.
Edward Thomson 76fd406a 2019-12-26T16:37:01 http: send probe packets When we're authenticating with a connection-based authentication scheme (NTLM, Negotiate), we need to make sure that we're still connected between the initial GET where we did the authentication and the POST that we're about to send. Our keep-alive session may have not kept alive, but more likely, some servers do not authenticate the entire keep-alive connection and may have "forgotten" that we were authenticated, namely Apache and nginx. Send a "probe" packet, that is an HTTP POST request to the upload-pack or receive-pack endpoint, that consists of an empty git pkt ("0000"). If we're authenticated, we'll get a 200 back. If we're not, we'll get a 401 back, and then we'll resend that probe packet with the first step of our authentication (asking to start authentication with the given scheme). We expect _yet another_ 401 back, with the authentication challenge. Finally, we will send our authentication response with the actual POST data. This will allow us to authenticate without draining the POST data in the initial request that gets us a 401.
Edward Thomson 7fd9b3f5 2020-01-01T20:48:15 ci: add NTLM tests Download poxygit, a debugging git server, and clone from it using NTLM, both IIS-style (with connection affinity) and Apache-style ("broken", requiring constant reauthentication).
Edward Thomson 29762e40 2020-01-01T16:14:37 httpclient: use defines for status codes
Edward Thomson 3e9ee04f 2019-12-29T18:46:44 trace: compare against an int value When tracing is disabled, don't let `git_trace__level` return a void, since that can't be compared against.
Edward Thomson b9c5b15a 2019-12-22T14:12:24 http: use the new httpclient Untangle the notion of the http transport from the actual http implementation. The http transport now uses the httpclient.
Edward Thomson 0b8358c8 2019-12-14T11:04:58 net: introduce path formatting function Introduce a function to format the path and query string for a URL, suitable for creating an HTTP request.
Edward Thomson 1152f361 2019-12-13T18:37:19 httpclient: consume final chunk message When sending a new request, ensure that we got the entirety of the response body. Our caller may have decided that they were done reading. If we were not at the end of the message, this means that we need to tear down the connection and cannot do keep-alive. However, if the caller read all of the message, but we still have a final end-of-response chunk signifier (ie, "0\r\n\r\n") on the socket, then we should consider that the response was successfully copmleted. If we're asked to send a new request, try to read from the socket, just to clear out that end-of-chunk message, marking ourselves as disconnected on any errors.
Edward Thomson dcd3b815 2019-12-13T15:28:57 tests: support CLAR_TRACE_LEVEL The CLAR_TRACE_LEVEL environment variable was supported when building with GIT_TRACE. Now we always build with GIT_TRACE, but that variable is not provided to tests. Simply support clar tracing always.
Edward Thomson 84b99a95 2019-12-12T13:53:43 httpclient: add chunk support to POST Teach httpclient how to support chunking when POSTing request bodies.
Edward Thomson bf55facf 2019-10-25T12:24:34 tests: allow users to use expect/continue
Edward Thomson eacecebd 2019-12-12T13:25:32 httpclient: introduce a simple http implementation Introduce a new http client implementation that can GET and POST to remote URLs. Consumers can use `git_http_client_init` to create a new client, `git_http_client_send_request` to send a request to the remote server and `git_http_client_read_response` to read the response. The http client implementation will perform the I/O with the remote server (http or https) but does not understand the git smart transfer protocol. This allows us to split the concerns of the http subtransport from the actual http implementation.
Edward Thomson a591f362 2019-12-09T19:48:10 net: introduce url formatting function
Edward Thomson 7372573b 2019-10-25T12:22:10 httpclient: support expect/continue Allow users to opt-in to expect/continue handling when sending a POST and we're authenticated with a "connection-based" authentication mechanism like NTLM or Negotiate. If the response is a 100, return to the caller (to allow them to post their body). If the response is *not* a 100, buffer the response for the caller. HTTP expect/continue is generally safe, but some legacy servers have not implemented it correctly. Require it to be opt-in.
Edward Thomson 6c21c989 2019-12-14T21:32:07 httpclient: support CONNECT proxies Fully support HTTP proxies, in particular CONNECT proxies, that allow us to speak TLS through a proxy.
Edward Thomson 6b208836 2019-12-18T21:55:28 httpclient: handle chunked responses Detect responses that are sent with Transfer-Encoding: chunked, and record that information so that we can consume the entire message body.
Edward Thomson 6a095679 2019-12-14T10:34:36 httpclient: support authentication Store the last-seen credential challenges (eg, all the 'WWW-Authenticate' headers in a response message). Given some credentials, find the best (first) challenge whose mechanism supports these credentials. (eg, 'Basic' supports username/password credentials, 'Negotiate' supports default credentials). Set up an authentication context for this mechanism and these credentials. Continue exchanging challenge/responses until we're authenticated.
Edward Thomson 0e39a8fa 2019-12-29T10:05:14 net: free the url's query component
Edward Thomson 2d6a61bd 2019-10-22T09:52:31 gssapi: validate that we were requested Negotiate
Edward Thomson e761df5c 2019-10-22T09:35:48 gssapi: dispose after completion for retry Disposal pattern; dispose on completion, allowing us to retry authentication, which may happen on web servers that close connection-based authenticated sessions (NTLM/SPNEGO) unexpectedly.
Edward Thomson d68f2b1a 2019-12-06T18:22:58 buf: add consume_bytes Allow users to consume a buffer by the number of bytes, not just to an ending pointer.
Edward Thomson e995f74e 2019-12-06T15:39:08 net: introduce git_net_url_joinpath Provide a mechanism to add a path and query string to an existing url so that we can easily append `/info/refs?...` type url segments to a url given to us by a user.
Edward Thomson 471daeea 2019-12-01T14:00:49 net: refactor gitno redirect handling Move the redirect handling into `git_net_url` for consistency.
Edward Thomson 297c61e4 2019-12-01T10:06:11 net: add an isvalid function (Also, mark all the declarations as extern.)
Edward Thomson a194e17f 2019-11-27T18:43:36 winhttp: refactor request sending Clarify what it means to not send a length; this allows us to refactor requests further.
Edward Thomson da9bc8ac 2019-11-27T23:42:16 ci: enable GSSAPI for Ubuntu builds
Edward Thomson 9b96adf3 2019-11-22T18:03:50 docker build: add krb5 libraries and command-line tools
Edward Thomson 031e3e4c 2019-11-27T14:20:44 ci: don't do negotiate tests on windows We can't get a kerberos TGT easily on Windows; skip the negotiate tests.
Edward Thomson fe4efe2e 2019-12-03T10:17:30 tests: test that clone returns 4321 This conditional was backwards. We should instead test that clone returns 4321, not that 4321 returns clone.
Edward Thomson 7e0f5a6a 2019-10-22T22:37:14 smart protocol: correct case in error messages
Edward Thomson 89d1fc2a 2019-10-22T09:30:50 gssapi: show information about disabled GSSAPI When USE_GSSAPI=OFF, still show information about what SPNEGO is, even though it's disabled. This is for parity with other disabled features like SSH and debugpool that still show details about what is disabled.
Jonathan Turcotte 5625892b 2019-09-20T12:06:11 gssapi: delete half-built security context so auth can continue
Edward Thomson 2174aa0a 2019-10-21T11:47:23 gssapi: correct incorrect case in error message
Edward Thomson 3f6fe054 2019-10-20T17:23:01 gssapi: protect GSS_ERROR macro The GSS_ERROR(x) macro may expand to `(x & value)` on some implementations, instead of `((x) & value)`. This is the case on macOS, which means that if we attempt to wrap an expression in that macro, like `a = b`, then that would expand to `(a = b & value)`. Since `&` has a higher precedence, this is not at all what we want, and will set our result code to an incorrect value. Evaluate the expression then test it with `GSS_ERROR` independently to avoid this.
Edward Thomson 73fe690d 2019-10-20T17:22:27 gssapi: protect against empty messages
Edward Thomson e5fb5fe5 2019-10-20T17:19:01 ci: perform SPNEGO tests Attempt to obtain a Kerberos ticket from LIBGIT2.ORG and then clone the Negotiate-protected site at test.libgit2.org with that ticket.
Patrick Steinhardt 9bcf10e9 2020-01-24T09:56:59 Merge pull request #5364 from libgit2/ethomson/typet internal types: change enums from `type_t` to `_t`
Edward Thomson 917ba762 2020-01-18T14:14:00 auth: update enum type name for consistency libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_http_authtype_t` to `git_http_auth_t` for consistency.
Edward Thomson b59c71d8 2020-01-18T14:11:01 iterator: update enum type name for consistency libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_iterator_type_t` to `git_iterator_t` for consistency.
Edward Thomson df3063ea 2020-01-18T14:04:44 rebase: update enum type name for consistency libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_rebase_type_t` to `git_rebase_t` for consistency.
Edward Thomson 94beb3a3 2020-01-18T14:03:23 merge: update enum type name for consistency libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_merge_diff_type_t` to `git_merge_diff_t` for consistency.
Patrick Steinhardt a76348ee 2020-01-17T08:38:00 Merge pull request #5358 from lrm29/git_merge_driver_source_repo_non_const merge: Return non-const git_repository from accessor method
Patrick Steinhardt 1908884d 2020-01-17T08:34:30 Merge pull request #5361 from csware/no-return-freed_object Do not return free'd git_repository object on error
Patrick Steinhardt 47ac1187 2020-01-17T08:32:37 Merge pull request #5360 from josharian/fix-5357 refs: refuse to delete HEAD
Edward Thomson a129941a 2020-01-16T17:44:55 Merge pull request #5351 from pks-t/pks/index-map-macros index: replace map macros with inline functions
Sven Strickroth 470a05d0 2020-01-16T17:53:50 Do not return free'd git_repository object on error Regression introduced in commit dde6d9c706bf1ecab545da55ab874a016587af1f. This issue causes lots of crashes in TortoiseGit. Signed-off-by: Sven Strickroth <email@cs-ware.de>
Josh Bleecher Snyder 852c83ee 2020-01-15T13:31:21 refs: refuse to delete HEAD This requires adding a new symbolic ref to the testrepo fixture. Some of the existing tests attempt to delete HEAD, expecting a different failure. Introduce and use a non-HEAD symbolic ref instead. Adjust a few other tests as needed. Fixes #5357
Edward Thomson dea5ce3d 2020-01-15T17:30:59 Merge pull request #5359 from tniessen/make-type-mismatch-errors-consistent Make type mismatch errors consistent
Tobias Nießen 5e1b6eaf 2020-01-15T12:58:59 Make type mismatch errors consistent
Laurence McGlashan 1bddbd02 2020-01-15T10:30:00 merge: Return non-const git_repository from git_merge_driver_source_repo accessor.
Patrick Steinhardt 7fc97eb3 2020-01-09T14:21:41 index: fix resizing index map twice on case-insensitive systems Depending on whether the index map is case-sensitive or insensitive, we need to call either `git_idxmap_icase_resize` or `git_idxmap_resize`. There are multiple locations where we thus use the following pattern: if (index->ignore_case && git_idxmap_icase_resize(map, length) < 0) return -1; else if (git_idxmap_resize(map, length) < 0) return -1; The funny thing is: on case-insensitive systems, we will try to resize the map twice in case where `git_idxmap_icase_resize()` doesn't error. While this will still use the correct hashing function as both map types use the same, this bug will at least cause us to resize the map twice in a row. Fix the issue by introducing a new function `index_map_resize` that handles case-sensitivity, similar to how `index_map_set` and `index_map_delete`. Convert all call sites where we were previously resizing the map to use that new function.
Patrick Steinhardt ab45887f 2020-01-09T14:15:02 index: replace map macros with inline functions Traditionally, our maps were mostly implemented via macros that had weird call semantics. This shows in our index code, where we have macros that insert into an index map case-sensitively or insensitively, as they still return error codes via an error parameter. This is unwieldy and, most importantly, not necessary anymore, due to the introduction of our high-level map API and removal of macros. Replace them with inlined functions to make code easier to read.
Edward Thomson cc4f4cbe 2020-01-12T10:12:57 Merge pull request #5355 from pks-t/pks/win32-relative-symlink-across-dirs win32: fix relative symlinks pointing into dirs
Edward Thomson d5482339 2020-01-10T11:13:25 Merge pull request #5354 from josharian/issue-5353 ntlm: prevent (spurious) compiler warnings
Patrick Steinhardt dbb6429c 2020-01-10T14:30:18 Merge pull request #5305 from kas-luthor/bugfix/multiple-auth Adds support for multiple SSH auth mechanisms being used sequentially
Patrick Steinhardt 7d55bee6 2020-01-10T12:44:51 win32: fix relative symlinks pointing into dirs On Windows platforms, we need some logic to emulate symlink(3P) defined by POSIX. As unprivileged symlinks on Windows are a rather new feature, our current implementation is comparatively new and still has some rough edges in special cases. One such case is relative symlinks. While relative symlinks to files in the same directory work as expected, libgit2 currently fails to create reltaive symlinks pointing into other directories. This is due to the fact that we forgot to translate the Unix-style target path to Windows-style. Most importantly, we are currently not converting directory separators from "/" to "\". Fix the issue by calling `git_win32_path_canonicalize` on the target. Add a test that verifies our ability to create such relative links across directories.
Patrick Steinhardt 9181e4b5 2020-01-10T12:02:10 Merge pull request #5339 from josharian/issue-5321 netops: handle intact query parameters in service_suffix removal
Josh Bleecher Snyder 93def7ad 2020-01-09T13:37:18 ntlm: prevent (spurious) compiler warnings Pull in commit https://github.com/ethomson/ntlmclient/commit/e7b2583e1bc28c33c43854e7c318e859b4e83bef to fix #5353.
Josh Bleecher Snyder 7142964f 2019-12-13T10:56:19 netops: handle intact query parameters in service_suffix removal Some servers leave the query parameters intact in the Location header when responding with a redirect. The service_suffix removal check as written assumed that the server removed them. Handle both cases. Along with PR #5325, this fixes #5321. There are two new tests. The first already passed; the second previously failed.
Edward Thomson 258188dd 2020-01-09T10:09:35 Merge pull request #5340 from pks-t/pks/pack-zstream Refactor packfile code to use zstream abstraction
Patrick Steinhardt 2dc7b5ef 2019-12-14T12:53:04 tests: pack: add missing asserts around `git_packbuilder_write`
Patrick Steinhardt 0edc26c8 2019-12-13T18:54:13 pack: refactor streams to use `git_zstream` While we do have a `git_zstream` abstraction that encapsulates all the calls to zlib as well as its error handling, we do not use it in our pack file code. Refactor it to make the code a lot easier to understand.
Patrick Steinhardt d8f6fee3 2019-12-13T14:57:53 pack: refactor unpacking of raw objects to use `git_zstream` While we do have a zstream abstraction that encapsulates all the calls to zlib as well as its error handling, we do not use it in our pack file code. Refactor it to make the code a lot easier to understand.
Edward Thomson ba64f50c 2020-01-08T09:51:12 Merge pull request #5322 from kdj0c/fix_sub_sync Fix git_submodule_sync with relative url
Patrick Steinhardt 11e8ee1f 2020-01-06T15:41:18 tests: submodule: verify setup of relative URLs When setting up relative URLs for a submodule, then we resolve it to the actual location and write that into ".git/config" instead of writing the relative value. We do not yet have a test to nail down this behaviour, which is now being added by this commit.
Patrick Steinhardt ff355778 2020-01-06T15:16:24 submodule: refactor code to match current coding style The submodule code has grown out-of-date regarding its coding style. Update `git_submodule_reload` and `git_submodule_sync` to more closely resemble what the rest of our code base uses.
kdj0c fbcc8bd1 2019-12-18T13:42:44 submodule sync, fix edge case with submodule sync on empty repo
kdj0c 42e0bed2 2019-12-05T10:43:17 Fix git_submodule_sync with relative url git_submodule_sync should resolve submodule before writing to .git/config to have the same behavior as git_submodule_init, which does the right thing.
Patrick Steinhardt 33f93bf3 2020-01-06T11:53:53 Merge pull request #5325 from josharian/no-double-slash http: avoid generating double slashes in url
Patrick Steinhardt f5173597 2020-01-06T11:45:47 Merge pull request #5348 from rcjsuen/patch-2 Correct typo in name of referenced parameter
Remy Suen 5930cf25 2020-01-02T14:57:55 Correct typo in name of referenced parameter Signed-off-by: Remy Suen <remy.suen@gmail.com>
Josh Bleecher Snyder 05c1fb8a 2019-12-06T11:04:40 http: avoid generating double slashes in url Prior to this change, given a remote url with a trailing slash, such as http://localhost/a/, service requests would contain a double slash: http://localhost/a//info/refs?service=git-receive-pack. Detect and prevent that. Updates #5321
Edward Thomson cb17630b 2019-12-14T06:59:19 Merge pull request #5338 from pks-t/pks/patch-null-arithmetic patch_parse: fix undefined behaviour due to arithmetic on NULL pointers
Edward Thomson e1d7747f 2019-12-14T06:58:52 Merge pull request #5337 from pks-t/pks/smart-pkt-ok-overflow smart_pkt: fix overflow resulting in OOB read/write of one byte
kas cb7fd1ed 2019-12-13T15:11:38 Fixes code styling
Patrick Steinhardt 2f6f10bb 2019-12-13T13:35:40 Merge pull request #5300 from tiennou/fix/branch-documentation branch: clarify documentation around branches
Patrick Steinhardt c6f9ad73 2019-12-13T13:18:54 patch_parse: fix undefined behaviour due to arithmetic on NULL pointers Doing arithmetic with NULL pointers is undefined behaviour in the C standard. We do so regardless when parsing patches, as we happily add a potential prefix length to prefixed paths. While this works out just fine as the prefix length is always equal to zero in these cases, thus resulting in another NULL pointer, it still is undefined behaviour and was pointed out to us by OSSfuzz. Fix the issue by checking whether paths are NULL, avoiding the arithmetic if they are.
Patrick Steinhardt 86852613 2019-12-13T12:13:05 smart_pkt: fix overflow resulting in OOB read/write of one byte When parsing OK packets, we copy any information after the initial "ok " prefix into the resulting packet. As newlines act as packet boundaries, we also strip the trailing newline if there is any. We do not check whether there is any data left after the initial "ok " prefix though, which leads to a pointer overflow in that case as `len == 0`: if (line[len - 1] == '\n') --len; This out-of-bounds read is a rather useless gadget, as we can only deduce whether at some offset there is a newline character. In case there accidentally is one, we overflow `len` to `SIZE_MAX` and then write a NUL byte into an array indexed by it: pkt->ref[len] = '\0'; Again, this doesn't seem like something that's possible to be exploited in any meaningful way, but it may surely lead to inconsistencies or DoS. Fix the issue by checking whether there is any trailing data after the packet prefix.
Etienne Samson 97b8491b 2019-12-08T15:25:52 refs: rename git_reference__set_name to git_reference__realloc As git_reference__name will reallocate storage to account for longer names (it's actually allocator-dependent), it will cause all existing pointers to the old object to become dangling, as they now point to freed memory. Fix the issue by renaming to a more descriptive name, and pass a pointer to the actual reference that can safely be invalidated if the realloc succeeds.
Patrick Steinhardt d2d01f71 2019-12-13T11:49:37 Merge pull request #5283 from pks-t/pks/example-checkout-remote-branch examples: checkout: implement guess heuristic for remote branches
Patrick Steinhardt 3e6a9045 2019-12-13T08:53:51 Merge pull request #5320 from josharian/minor-docs Minor doc improvements
Patrick Steinhardt b3178587 2019-12-13T08:35:25 Merge pull request #5333 from lrm29/attr_binary_macro attr: Update definition of binary macro
Laurence McGlashan cf286d5e 2019-12-12T10:58:56 attr: Update definition of binary macro
Patrick Steinhardt 6777db8e 2019-12-10T20:40:17 Merge pull request #5331 from pks-t/security-fixes Security fixes for master
Patrick Steinhardt b8b8eee3 2019-12-10T13:44:27 changelog: document security fixes
Edward Thomson 14ff3516 2019-12-03T23:15:47 path: support non-ascii drive letters on dos Windows/DOS only supports drive letters that are alpha characters A-Z. However, you can `subst` any one-character as a drive letter, including numbers or even emoji. Test that we can identify emoji as drive letters.
Edward Thomson 85d4ff77 2019-12-03T19:50:18 index: ensure that we respect core.protectNTFS=false Users may want to turn off core.protectNTFS, perhaps to import (and then repair) a broken tree. Ensure that core.protectNTFS=false is honored.
Edward Thomson ba4c769b 2019-12-03T23:23:02 tree: ensure we protect NTFS paths everywhere
Edward Thomson e4034dfa 2019-12-03T19:24:59 path: protect NTFS everywhere Enable core.protectNTFS by default everywhere and in every codepath, not just on checkout.
Edward Thomson d9c0c9cf 2019-12-03T19:17:41 test: ensure we can't add a protected path Test that when we enable core.protectNTFS that we cannot add platform-specific invalid paths to the index.
Edward Thomson 72df1cd8 2019-12-03T19:01:00 test: improve badname verification test The name of the `add_invalid_filename` function suggests that we _want_ to add an invalid filename. Rename the function to show that we expect to _fail_ to add the invalid filename.
Edward Thomson f3b28604 2019-12-03T18:57:16 test: ensure treebuilder validate new protection rules Ensure that the new protection around .git::$INDEX_ALLOCATION rules are enabled for using the treebuilder when core.protectNTFS is set.
Edward Thomson 336991db 2019-12-03T18:56:31 test: ensure index adds validate new protection rules Ensure that the new protection around .git::$INDEX_ALLOCATION rules are enabled for adding to the index when core.protectNTFS is set.
Edward Thomson a3cbd204 2019-12-03T18:49:23 test: improve badname verification test The name of the `write_invalid_filename` function suggests that we _want_ to write an invalid filename. Rename the function to show that we expect to _fail_ to write the invalid filename.
Edward Thomson b8464342 2019-12-03T17:47:31 path: rename function that detects end of filename The function `only_spaces_and_dots` used to detect the end of the filename on win32. Now we look at spaces and dots _before_ the end of the string _or_ a `:` character, which would signify a win32 alternate data stream. Thus, rename the function `ntfs_end_of_filename` to indicate that it detects the (virtual) end of a filename, that any further characters would be elided to the given path.
Johannes Schindelin e1832eb2 2019-09-18T16:33:18 path: also guard `.gitmodules` against NTFS Alternate Data Streams We just safe-guarded `.git` against NTFS Alternate Data Stream-related attack vectors, and now it is time to do the same for `.gitmodules`. Note: In the added regression test, we refrain from verifying all kinds of variations between short names and NTFS Alternate Data Streams: as the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it is enough to test one in order to know that all of them are guarded against. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Johannes Schindelin 3f7851ea 2019-09-18T14:32:05 Disallow NTFS Alternate Data Stream attacks, even on Linux/macOS A little-known feature of NTFS is that it offers to store metadata in so-called "Alternate Data Streams" (inspired by Apple's "resource forks") that are copied together with the file they are associated with. These Alternate Data Streams can be accessed via `<file name>:<stream name>:<stream type>`. Directories, too, have Alternate Data Streams, and they even have a default stream type `$INDEX_ALLOCATION`. Which means that `abc/` and `abc::$INDEX_ALLOCATION/` are actually equivalent. This is of course another attack vector on the Git directory that we definitely want to prevent. On Windows, we already do this incidentally, by disallowing colons in file/directory names. While it looks as if files'/directories' Alternate Data Streams are not accessible in the Windows Subsystem for Linux, and neither via CIFS/SMB-mounted network shares in Linux, it _is_ possible to access them on SMB-mounted network shares on macOS. Therefore, let's go the extra mile and prevent this particular attack _everywhere_. To keep things simple, let's just disallow *any* Alternate Data Stream of `.git`. This is libgit2's variant of CVE-2019-1352. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>