|
51eff5a5
|
2020-05-29T13:13:19
|
|
strarray: we should `dispose` instead of `free`
We _dispose_ the contents of objects; we _free_ objects (and their
contents). Update `git_strarray_free` to be `git_strarray_dispose`.
`git_strarray_free` remains as a deprecated proxy function.
|
|
172a2886
|
2020-06-01T14:04:15
|
|
Merge pull request #5529 from libgit2/ethomson/difftest
diff::workdir: actually test the buffers
|
|
|
1bbdf15d
|
2020-06-01T13:57:12
|
|
Merge pull request #5527 from libgit2/ethomson/config_unreadable
Handle unreadable configuration files
|
|
|
9df69223
|
2020-05-23T11:42:19
|
|
config: test that unreadable files are treated as notfound
|
|
1a899008
|
2020-05-26T20:36:13
|
|
tests: index::version: write v4 index: re-open repo to read written v4 index
The `git_index_free()` merely decrement the reference counter from 2 to
1, and does not "free" the index.
Thus, the following `git_repository_index()` merely increase the counter
to 2, instead of read index from disk.
The written index is not read and parsed, which makes this test case
effectively becomes a no-op.
|
|
|
3414d470
|
2020-05-23T16:27:56
|
|
diff::workdir: actually test the buffers
The static test data is erroneously initialized with a length of 0 for
three of the strings. This means the tests are not actually examining
those strings. Provide the length.
|
|
|
f88e12db
|
2020-05-23T09:35:53
|
|
checkout::index: free the index
|
|
|
915f8860
|
2020-05-16T14:00:11
|
|
tests: checkout: fix stylistic issues and static variable
The test case checkout::index::can_disable_pathspec_match has some
shortcomings when it comes to coding style, which didn't fit our own
coding style. Furthermore, it had an unnecessary static local variable.
The test has been refactored to address these issues.
|
|
|
0cf9b666
|
2020-05-12T11:41:44
|
|
tests: merge: fix printf formatter on 32 bit arches
We currently use `PRIuMAX` to print an integer of type `size_t` in
merge::trees::rename::cache_recomputation. While this works just fine on
64 bit arches, it doesn't on 32 bit ones. As a result, our nightly
builds on x86 and arm32 fail.
Fix the issue by using `PRIuZ` instead.
|
|
|
cbae1c21
|
2020-04-01T22:12:07
|
|
assert: allow non-int returning functions to assert
Include GIT_ASSERT_WITH_RETVAL and GIT_ASSERT_ARG_WITH_RETVAL so that
functions that do not return int (or more precisely, where `-1` would
not be an error code) can assert.
This allows functions that return, eg, NULL on an error code to do that
by passing the return value (in this example, `NULL`) as a second
parameter to the GIT_ASSERT_WITH_RETVAL functions.
|
|
|
a95096ba
|
2020-01-12T10:31:07
|
|
assert: optionally fall-back to assert(3)
Fall back to the system assert(3) in debug builds, which may aide
in debugging.
"Safe" assertions can be enabled in debug builds by setting
GIT_ASSERT_HARD=0. Similarly, hard assertions can be enabled in
release builds by setting GIT_ASSERT_HARD to nonzero.
|
|
|
abe2efe1
|
2019-12-09T12:37:34
|
|
Introduce GIT_ASSERT macros
Provide macros to replace usages of `assert`. A true `assert` is
punishing as a library. Instead we should do our best to not crash.
GIT_ASSERT_ARG(x) will now assert that the given argument complies to
some format and sets an error message and returns `-1` if it does not.
GIT_ASSERT(x) is for internal usage, and available as an internal
consistency check. It will set an error message and return `-1` in the
event of failure.
|
|
d62e44cb
|
2019-06-03T18:35:08
|
|
checkout: Fix removing untracked files by path in subdirectories
The checkout code didn't iterate into a subdir if it didn't match the
pathspec, but since the pathspec might match files in the subdir we
should recurse into it (In contrast to gitignore handling).
Fixes #5089
|
|
|
8731e1f4
|
2020-02-02T19:01:15
|
|
tests::checkout: only examine test10 and test11.txt
The checkout::index::can_disable_pathspec_match test attempts to set a
path filter of `test11.txt` and `test12.txt`, but then validates that
`test10.txt` and `test11.txt` were left unmodified. Update the test's
path filter to match the expectation.
|
|
24bd12c4
|
2020-02-02T01:00:15
|
|
Create test case demonstrating checkout bug w/ pathspec match disabled
|
|
9830ab3d
|
2020-01-29T02:00:04
|
|
blame: add option to ignore whitespace changes
|
|
|
5a1ec7ab
|
2020-04-04T13:37:13
|
|
Merge pull request #5480 from libgit2/ethomson/coverity
repo::open: ensure we can open the repository
|
|
|
966db47d
|
2020-04-04T13:21:02
|
|
Merge pull request #5477 from pks-t/pks/rename-detection-negative-caches
merge: cache negative cache results for similarity metrics
|
|
|
cb0cfc5a
|
2020-04-03T09:17:52
|
|
repo::open: ensure we can open the repository
Update the test cases to check the `git_repository_open` return code.
|
|
|
dfd7fcc4
|
2020-04-02T13:26:13
|
|
Merge pull request #5388 from bk2204/repo-format-v1
Handle repository format v1
|
|
|
4dfcc50f
|
2020-04-01T15:16:18
|
|
merge: cache negative cache results for similarity metrics
When computing renames, we cache the hash signatures for each of the
potentially conflicting entries so that we do not need to repeatedly
read the file and can at least halfway efficiently determine whether two
files are similar enough to be deemed a rename. In order to make the
hash signatures meaningful, we require at least four lines of data to be
present, resulting in at least four different hashes that can be
compared. Files that are deemed too small are not cached at all and
will thus be repeatedly re-hashed, which is usually not a huge issue.
The issue with above heuristic is in case a file does _not_ have at
least four lines, where a line is anything separated by a consecutive
run of "\n" or "\0" characters. For example "a\nb" is two lines, but
"a\0\0b" is also just two lines. Taken to the extreme, a file that has
megabytes of consecutive space- or NUL-only may also be deemed as too
small and thus not get cached. As a result, we will repeatedly load its
blob, calculate its hash signature just to finally throw it away as we
notice it's not of any value. When you've got a comparitively big file
that you compare against a big set of potentially renamed files, then
the cost simply expodes.
The issue can be trivially fixed by introducing negative cache entries.
Whenever we determine that a given blob does not have a meaningful
representation via a hash signature, we store this negative cache marker
and will from then on not hash it again, but also ignore it as a
potential rename target. This should help the "normal" case already
where you have a lot of small files as rename candidates, but in the
above scenario it's savings are extraordinarily high.
To verify we do not hit the issue anymore with described solution, this
commit adds a test that uses the exact same setup described above with
one 50 megabyte blob of '\0' characters and 1000 other files that get
renamed. Without the negative cache:
$ time ./libgit2_clar -smerge::trees::renames::cache_recomputation >/dev/null
real 11m48.377s
user 11m11.576s
sys 0m35.187s
And with the negative cache:
$ time ./libgit2_clar -smerge::trees::renames::cache_recomputation >/dev/null
real 0m1.972s
user 0m1.851s
sys 0m0.118s
So this represents a ~350-fold performance improvement, but it obviously
depends on how many files you have and how big the blob is. The test
number were chosen in a way that one will immediately notice as soon as
the bug resurfaces.
|
|
|
5f47cb48
|
2020-03-26T14:16:41
|
|
patch: correctly handle mode changes for renames
When generating a patch for a renamed file whose mode bits have changed
in addition to the rename, then we currently fail to parse the generated
patch. Furthermore, when generating a diff we output mode bits after the
similarity metric, which is different to how upstream git handles it.
Fix both issues by adding another state transition that allows
similarity indices after mode changes and by printing mode changes
before the similarity index.
|
|
62d59467
|
2020-03-08T02:13:11
|
|
Fix segfault when calling git_blame_buffer()
This change makes sure that the hunk is not null before trying to
dereference it. This avoids segfaults, especially when blaming against a
modified buffer (i.e. the index).
Fixes: #5443
|
|
|
163db8f2
|
2020-02-28T18:53:22
|
|
win32: test relative symlinks
Ensure that we don't canonicalize symlink targets.
|
|
|
f2b114ba
|
2020-03-08T18:11:45
|
|
win32: introduce relative path handling function
Add a function that takes a (possibly) relative UTF-8 path and emits a
UTF-16 path with forward slashes translated to backslashes. If the
given path is, in fact, absolute, it will be translated to absolute path
handling rules.
|
|
|
fb7da154
|
2020-03-08T16:34:23
|
|
win32: clarify usage of path canonicalization funcs
The path canonicalization functions on win32 are intended to
canonicalize absolute paths; those with prefixes. In other words,
things start with drive letters (`C:\`), share names (`\\server\share`),
or other prefixes (`\\?\`).
This function removes leading `..` that occur after the prefix but
before the directory/file portion (eg, turning `C:\..\..\..\foo` into
`C:\foo`). This translation is not appropriate for local paths.
|
|
|
81370261
|
2020-02-19T15:57:39
|
|
Merge pull request #5374 from pks-t/pks/diff-with-empty-subtree
tests: diff: verify that we are able to diff with empty subtrees
|
|
|
8aa04a37
|
2020-02-19T12:14:16
|
|
Merge pull request #5391 from pks-t/pks/coverity-fixes
Coverity fixes
|
|
|
eaa70c6c
|
2020-02-18T18:09:11
|
|
tests: object: decrease number of concurrent cache accesses
In our test case object::cache::fast_thread_rush, we're creating 100
concurrent threads opening a repository and reading objects from it.
This test actually fails on ARM32 with an out-of-memory error, which
isn't entirely unexpected.
Work around the issue by halving the number of threads.
|
|
06f02300
|
2020-02-07T00:33:52
|
|
repository: handle format v1
Git has supported repository format version 1 for some time. This
format is just like version 0, but it supports extensions.
Implementations must reject extensions that they don't support.
Add support for this format version and reject any extensions but
extensions.noop, which is the only extension we currently support.
While we're at it, also clean up an error message.
|
|
|
17670ef2
|
2020-02-04T10:58:51
|
|
tests: diff: add test to verify behaviour with empty dir ordering
It was reported that, given a file "abc.txt", a diff will be shown if an
empty directory "abb/" is created, but not if "abd/" is created. Add a
test to verify that we do the right thing here and do not depend on any
ordering.
|
|
|
b0691db3
|
2020-01-31T09:39:12
|
|
tests: diff: verify that we are able to diff with empty subtrees
While it is not allowed for a tree to have an empty tree as child (e.g.
an empty directory), libgit2's tree builder makes it easy to create such
trees. As a result, some applications may inadvertently end up with such
an invalid tree, and we should try our best and handle them.
One such case is when diffing two trees, where one of both trees has
such an empty subtree. It was reported that this will cause our diff
code to fail. While I wasn't able to reproduce this error, let's still
add a test that verifies we continue to handle them correctly.
|
|
|
26b71d60
|
2020-02-07T14:36:10
|
|
tests: iterator: fix iterator expecting too few items
The testcase iterator::workdir::filesystem_gunk sets up quite a lot of
directories, which is why it only runs in case GITTEST_INVASIVE_SPEED is
set in the environment. Because we do not run our default CI with this
variable, we didn't notice commit 852c83ee4 (refs: refuse to delete
HEAD, 2020-01-15) breaking the test as it introduced a new reference to
the "testrepo" repository.
Fix the oversight by increasing the number of expected iterator items.
|
|
|
2e6cbff8
|
2020-02-07T11:53:51
|
|
tests: add missing error checks
We should always verify error codes returned by function calls in our
test suite to not accidentally miss any weird results. Coverity reported
missing checks in several locations, which this commit fixes.
|
|
|
7d65d4cb
|
2020-02-07T11:39:24
|
|
tests: blame: fix conversion specifiers in format string
While the blame helper function `hunk_message` accepts a printf-style
format string, we didn't add a compiler attribute to let the compiler
check for correct conversion specifiers. As a result, some users of the
function used wrong specifiers.
Add the GIT_FORMAT_PRINTF attribute to the function and fix resulting
warnings by using the correct specifiers.
|
|
|
46228d86
|
2020-02-06T11:10:27
|
|
transports: http: fix custom headers not being applied
In commit b9c5b15a7 (http: use the new httpclient, 2019-12-22), the HTTP
code got refactored to extract a generic HTTP client that operates
independently of the Git protocol. Part of refactoring was the creation
of a new `git_http_request` struct that encapsulates the generation of
requests. Our Git-specific HTTP transport was converted to use that in
`generate_request`, but during the process we forgot to set up custom
headers for the `git_http_request` and as a result we do not send out
these headers anymore.
Fix the issue by correctly setting up the request's custom headers and
add a test to verify we correctly send them.
|
|
|
93a9044f
|
2020-01-31T08:49:34
|
|
fetchhead: strip credentials from remote URL
If fetching from an anonymous remote via its URL, then the URL gets
written into the FETCH_HEAD reference. This is mainly done to give
valuable context to some commands, like for example git-merge(1), which
will put the URL into the generated MERGE_MSG. As a result, what gets
written into FETCH_HEAD may become public in some cases. This is
especially important considering that URLs may contain credentials, e.g.
when cloning 'https://foo:bar@example.com/repo' we persist the complete
URL into FETCH_HEAD and put it without any kind of sanitization into the
MERGE_MSG. This is obviously bad, as your login data has now just leaked
as soon as you do git-push(1).
When writing the URL into FETCH_HEAD, upstream git does strip
credentials first. Let's do the same by trying to parse the remote URL
as a "real" URL, removing any credentials and then re-formatting the
URL. In case this fails, e.g. when it's a file path or not a valid URL,
we just fall back to using the URL as-is without any sanitization. Add
tests to verify our behaviour.
|
|
|
3f54ba8b
|
2020-01-18T13:51:40
|
|
credential: change git_cred to git_credential
We avoid abbreviations where possible; rename git_cred to
git_credential.
In addition, we have standardized on a trailing `_t` for enum types,
instead of using "type" in the name. So `git_credtype_t` has become
`git_credential_t` and its members have become `GIT_CREDENTIAL` instead
of `GIT_CREDTYPE`.
Finally, the source and header files have been renamed to `credential`
instead of `cred`.
Keep previous name and values as deprecated, and include the new header
files from the previous ones.
|
|
|
7fd9b3f5
|
2020-01-01T20:48:15
|
|
ci: add NTLM tests
Download poxygit, a debugging git server, and clone from it using NTLM,
both IIS-style (with connection affinity) and Apache-style ("broken",
requiring constant reauthentication).
|
|
|
bf55facf
|
2019-10-25T12:24:34
|
|
tests: allow users to use expect/continue
|
|
|
dcd3b815
|
2019-12-13T15:28:57
|
|
tests: support CLAR_TRACE_LEVEL
The CLAR_TRACE_LEVEL environment variable was supported when building
with GIT_TRACE. Now we always build with GIT_TRACE, but that variable
is not provided to tests. Simply support clar tracing always.
|
|
|
e995f74e
|
2019-12-06T15:39:08
|
|
net: introduce git_net_url_joinpath
Provide a mechanism to add a path and query string to an existing url
so that we can easily append `/info/refs?...` type url segments to a url
given to us by a user.
|
|
|
471daeea
|
2019-12-01T14:00:49
|
|
net: refactor gitno redirect handling
Move the redirect handling into `git_net_url` for consistency.
|
|
|
fe4efe2e
|
2019-12-03T10:17:30
|
|
tests: test that clone returns 4321
This conditional was backwards. We should instead test that clone
returns 4321, not that 4321 returns clone.
|
|
|
e5fb5fe5
|
2019-10-20T17:19:01
|
|
ci: perform SPNEGO tests
Attempt to obtain a Kerberos ticket from LIBGIT2.ORG and then clone the
Negotiate-protected site at test.libgit2.org with that ticket.
|
|
|
94beb3a3
|
2020-01-18T14:03:23
|
|
merge: update enum type name for consistency
libgit2 does not use `type_t` suffixes as it's redundant; thus, rename
`git_merge_diff_type_t` to `git_merge_diff_t` for consistency.
|
|
|
1908884d
|
2020-01-17T08:34:30
|
|
Merge pull request #5361 from csware/no-return-freed_object
Do not return free'd git_repository object on error
|
|
470a05d0
|
2020-01-16T17:53:50
|
|
Do not return free'd git_repository object on error
Regression introduced in commit dde6d9c706bf1ecab545da55ab874a016587af1f.
This issue causes lots of crashes in TortoiseGit.
Signed-off-by: Sven Strickroth <email@cs-ware.de>
|
|
852c83ee
|
2020-01-15T13:31:21
|
|
refs: refuse to delete HEAD
This requires adding a new symbolic ref to the testrepo fixture.
Some of the existing tests attempt to delete HEAD, expecting a different failure. Introduce and use a non-HEAD symbolic ref instead.
Adjust a few other tests as needed.
Fixes #5357
|
|
|
7d55bee6
|
2020-01-10T12:44:51
|
|
win32: fix relative symlinks pointing into dirs
On Windows platforms, we need some logic to emulate symlink(3P) defined
by POSIX. As unprivileged symlinks on Windows are a rather new feature,
our current implementation is comparatively new and still has some
rough edges in special cases.
One such case is relative symlinks. While relative symlinks to files in
the same directory work as expected, libgit2 currently fails to create
reltaive symlinks pointing into other directories. This is due to the
fact that we forgot to translate the Unix-style target path to
Windows-style. Most importantly, we are currently not converting
directory separators from "/" to "\".
Fix the issue by calling `git_win32_path_canonicalize` on the target.
Add a test that verifies our ability to create such relative links
across directories.
|
|
|
7142964f
|
2019-12-13T10:56:19
|
|
netops: handle intact query parameters in service_suffix removal
Some servers leave the query parameters intact in the
Location header when responding with a redirect.
The service_suffix removal check as written assumed
that the server removed them.
Handle both cases.
Along with PR #5325, this fixes #5321.
There are two new tests. The first already passed;
the second previously failed.
|
|
|
2dc7b5ef
|
2019-12-14T12:53:04
|
|
tests: pack: add missing asserts around `git_packbuilder_write`
|
|
|
11e8ee1f
|
2020-01-06T15:41:18
|
|
tests: submodule: verify setup of relative URLs
When setting up relative URLs for a submodule, then we resolve it to
the actual location and write that into ".git/config" instead of
writing the relative value. We do not yet have a test to nail down this
behaviour, which is now being added by this commit.
|
|
|
2f6f10bb
|
2019-12-13T13:35:40
|
|
Merge pull request #5300 from tiennou/fix/branch-documentation
branch: clarify documentation around branches
|
|
97b8491b
|
2019-12-08T15:25:52
|
|
refs: rename git_reference__set_name to git_reference__realloc
As git_reference__name will reallocate storage to account for longer
names (it's actually allocator-dependent), it will cause all existing
pointers to the old object to become dangling, as they now point to
freed memory.
Fix the issue by renaming to a more descriptive name, and pass a pointer
to the actual reference that can safely be invalidated if the realloc
succeeds.
|
|
|
b3178587
|
2019-12-13T08:35:25
|
|
Merge pull request #5333 from lrm29/attr_binary_macro
attr: Update definition of binary macro
|
|
cf286d5e
|
2019-12-12T10:58:56
|
|
attr: Update definition of binary macro
|
|
|
14ff3516
|
2019-12-03T23:15:47
|
|
path: support non-ascii drive letters on dos
Windows/DOS only supports drive letters that are alpha characters A-Z.
However, you can `subst` any one-character as a drive letter, including
numbers or even emoji. Test that we can identify emoji as drive
letters.
|
|
|
85d4ff77
|
2019-12-03T19:50:18
|
|
index: ensure that we respect core.protectNTFS=false
Users may want to turn off core.protectNTFS, perhaps to import (and then
repair) a broken tree. Ensure that core.protectNTFS=false is honored.
|
|
|
ba4c769b
|
2019-12-03T23:23:02
|
|
tree: ensure we protect NTFS paths everywhere
|
|
|
e4034dfa
|
2019-12-03T19:24:59
|
|
path: protect NTFS everywhere
Enable core.protectNTFS by default everywhere and in every codepath, not
just on checkout.
|
|
|
d9c0c9cf
|
2019-12-03T19:17:41
|
|
test: ensure we can't add a protected path
Test that when we enable core.protectNTFS that we cannot add
platform-specific invalid paths to the index.
|
|
|
72df1cd8
|
2019-12-03T19:01:00
|
|
test: improve badname verification test
The name of the `add_invalid_filename` function suggests that we
_want_ to add an invalid filename. Rename the function to show that
we expect to _fail_ to add the invalid filename.
|
|
|
f3b28604
|
2019-12-03T18:57:16
|
|
test: ensure treebuilder validate new protection rules
Ensure that the new protection around .git::$INDEX_ALLOCATION rules are
enabled for using the treebuilder when core.protectNTFS is set.
|
|
|
336991db
|
2019-12-03T18:56:31
|
|
test: ensure index adds validate new protection rules
Ensure that the new protection around .git::$INDEX_ALLOCATION rules are
enabled for adding to the index when core.protectNTFS is set.
|
|
|
a3cbd204
|
2019-12-03T18:49:23
|
|
test: improve badname verification test
The name of the `write_invalid_filename` function suggests that we
_want_ to write an invalid filename. Rename the function to show that
we expect to _fail_ to write the invalid filename.
|
|
e1832eb2
|
2019-09-18T16:33:18
|
|
path: also guard `.gitmodules` against NTFS Alternate Data Streams
We just safe-guarded `.git` against NTFS Alternate Data Stream-related
attack vectors, and now it is time to do the same for `.gitmodules`.
Note: In the added regression test, we refrain from verifying all kinds
of variations between short names and NTFS Alternate Data Streams: as
the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it
is enough to test one in order to know that all of them are guarded
against.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|
|
|
3f7851ea
|
2019-09-18T14:32:05
|
|
Disallow NTFS Alternate Data Stream attacks, even on Linux/macOS
A little-known feature of NTFS is that it offers to store metadata in
so-called "Alternate Data Streams" (inspired by Apple's "resource
forks") that are copied together with the file they are associated with.
These Alternate Data Streams can be accessed via `<file name>:<stream
name>:<stream type>`.
Directories, too, have Alternate Data Streams, and they even have a
default stream type `$INDEX_ALLOCATION`. Which means that `abc/` and
`abc::$INDEX_ALLOCATION/` are actually equivalent.
This is of course another attack vector on the Git directory that we
definitely want to prevent.
On Windows, we already do this incidentally, by disallowing colons in
file/directory names.
While it looks as if files'/directories' Alternate Data Streams are not
accessible in the Windows Subsystem for Linux, and neither via
CIFS/SMB-mounted network shares in Linux, it _is_ possible to access
them on SMB-mounted network shares on macOS.
Therefore, let's go the extra mile and prevent this particular attack
_everywhere_. To keep things simple, let's just disallow *any* Alternate
Data Stream of `.git`.
This is libgit2's variant of CVE-2019-1352.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|
|
|
64c612cc
|
2019-09-18T15:25:02
|
|
Protect against 8.3 "short name" attacks also on Linux/macOS
The Windows Subsystem for Linux (WSL) is getting increasingly popular,
in particular because it makes it _so_ easy to run Linux software on
Windows' files, via the auto-mounted Windows drives (`C:\` is mapped to
`/mnt/c/`, no need to set that up manually).
Unfortunately, files/directories on the Windows drives can be accessed
via their _short names_, if that feature is enabled (which it is on the
`C:` drive by default).
Which means that we have to safeguard even our Linux users against the
short name attacks.
Further, while the default options of CIFS/SMB-mounts seem to disallow
accessing files on network shares via their short names on Linux/macOS,
it _is_ possible to do so with the right options.
So let's just safe-guard against short name attacks _everywhere_.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|
|
|
d29d4de2
|
2019-09-18T15:08:56
|
|
cl_git_fail: do not report bogus error message
When we expect a checkout operation to fail, but it succeeds, we
actually do not want to see the error messages that were generated in
the meantime for errors that were handled gracefully by the code (e.g.
when an object could not be found in a pack: in this case, the next
backend would have been given a chance to look up the object, and
probably would have found it because the checkout succeeded, after all).
Which means that in the specific case of `cl_git_fail()`, we actually
want to clear the global error state _after_ evaluating the command: we
know that any still-available error would be bogus, seeing as the
command succeeded (unexpectedly).
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
|
|
|
7f6fdb82
|
2019-12-01T14:11:22
|
|
Merge pull request #5312 from pks-t/pks/patch-base85-overflow
patch_parse: fix out-of-bounds reads caused by integer underflow
|
|
|
7f20778b
|
2019-11-29T09:14:04
|
|
Merge pull request #5311 from pks-t/pks/clar-trace-warning
tests: fix compiler warning if tracing is disabled
|
|
|
361ebbcb
|
2019-11-28T15:36:40
|
|
tests: config: only test parsing huge file with GITTEST_INVASIVE_SPEED
The test in config::stress::huge_section_with_many_values takes quite a
long time to execute. Hide it behind the GITTEST_INVASIVE_SPEED
environment varibale to not needlessly blow up execution time of tests.
As this environment variable is being set by the continuous integration,
we will execute it regularly anyway.
|
|
|
33e6c402
|
2019-11-28T15:26:36
|
|
patch_parse: fix out-of-bounds reads caused by integer underflow
The patch format for binary files is a simple Base85 encoding with a
length byte as prefix that encodes the current line's length. For each
line, we thus check whether the line's actual length matches its
expected length in order to not faultily apply a truncated patch. This
also acts as a check to verify that we're not reading outside of the
line's string:
if (encoded_len > ctx->parse_ctx.line_len - 1) {
error = git_parse_err(...);
goto done;
}
There is the possibility for an integer underflow, though. Given a line
with a single prefix byte, only, `line_len` will be zero when reaching
this check. As a result, subtracting one from that will result in an
integer underflow, causing us to assume that there's a wealth of bytes
available later on. Naturally, this may result in an out-of-bounds read.
Fix the issue by checking both `encoded_len` and `line_len` for a
non-zero value. The binary format doesn't make use of zero-length lines
anyway, so we need to know that there are both encoded bytes and
remaining characters available at all.
This patch also adds a test that works based on the last error message.
Checking error messages is usually too tightly coupled, but in fact
parsing the patch failed even before the change. Thus the only
possibility is to use e.g. Valgrind, but that'd result in us not
catching issues when run without Valgrind. As a result, using the error
message is considered a viable tradeoff as we know that we didn't start
decoding Base85 in the first place.
|
|
|
1d470a71
|
2019-11-28T14:45:15
|
|
tests: fix compiler warning if tracing is disabled
If building libgit2's test suite with tracing disabled, then the
compiler will emit a warning due to the unused `message_prefix`
function. Fix the issue by wrapping the whole file into ifdef's for
`GIT_TRACE` and providing separate empty function implementations for
both `cl_global_trace_register` and `cl_global_trace_disable`.
|
|
|
fb439c97
|
2019-11-28T14:41:58
|
|
Merge pull request #5306 from herrerog/patchid
diff: complete support for git patchid
|
|
|
61176a9b
|
2019-11-28T14:31:16
|
|
Merge pull request #5243 from pks-t/pks/config-optimize-mem
Memory optimizations for config entries
|
|
ece5bb5e
|
2019-11-07T14:10:00
|
|
diff: make patchid computation work with all types of commits.
Current implementation of patchid is not computing a correct patchid
when given a patch where, for example, a new file is added or removed.
Some more corner cases need to be handled to have same behavior as git
patch-id command.
Add some more tests to cover those corner cases.
Signed-off-by: Gregory Herrero <gregory.herrero@oracle.com>
|
|
|
b63ad958
|
2019-11-28T13:19:50
|
|
Merge pull request #5309 from libgit2/ethomson/trace
Improve trace support in tests
|
|
|
0e5243b7
|
2019-11-28T12:42:36
|
|
Merge pull request #5123 from libgit2/ethomson/off_t
Move `git_off_t` to `git_object_size_t`
|
|
|
b7f70bc2
|
2019-11-27T12:36:17
|
|
tests: optionally show test execution tracing
Only show test trace execution when the CLAR_TRACE_TESTS environment
variable is set. This reduces the noise during tracing.
|
|
|
85efe896
|
2019-11-27T12:34:10
|
|
tests: display trace level with prefix in tests
|
|
|
6460e8ab
|
2019-06-23T18:13:29
|
|
internal: use off64_t instead of git_off_t
Prefer `off64_t` internally.
|
|
|
0005c77a
|
2019-11-24T15:49:49
|
|
test: add an azure repos test
We currently talk to Azure Repos for executing an online test
(online::clone::path_whitespace). Add a simpler test to talk to Azure
Repos to make it obvious that strange test failures are not likely the
whitespace in the path, but actually a function of talking to Azure
Repos itself.
|
|
|
048e94ad
|
2019-11-07T14:13:14
|
|
patch_parse: correct parsing of patch containing not shown binary data.
When not shown binary data is added or removed in a patch, patch parser
is currently returning 'error -1 - corrupt git binary header at line 4'.
Fix it by correctly handling case where binary data is added/removed.
Signed-off-by: Gregory Herrero <gregory.herrero@oracle.com>
|
|
|
de7659cc
|
2019-11-10T18:44:56
|
|
patch_parse: use paths from "---"/"+++" lines for binary patches
For some patches, it is not possible to derive the old and new file
paths from the patch header's first line, most importantly when they
contain spaces. In such a case, we derive both paths from the "---" and
"+++" lines, which allow for non-ambiguous parsing. We fail to use these
paths when parsing binary patches without data, though, as we always
expect the header paths to be filled in.
Fix this by using the "---"/"+++" paths by default and only fall back to
header paths if they aren't set. If neither of those paths are set, we
just return an error. Add two tests to verify this behaviour, one of
which would have previously caused a segfault.
|
|
|
01ea911b
|
2019-11-06T06:04:55
|
|
Merge pull request #5299 from pks-t/pks/config-mem-snapshots
config_mem: implement support for snapshots
|
|
|
146e5bf7
|
2019-11-06T07:27:35
|
|
config_mem: implement support for snapshots
Similar as in commit dadbb33b6 (Fix crash if snapshotting a
config_snapshot, 2019-11-01), let's implement snapshots for in-memory
configuration entries. As this deletes more code than it adds, it
doesn't make any sense to not allow for this and allows users to treat
config backends mostly the same.
|
|
|
de543e29
|
2019-11-05T22:44:27
|
|
patch_parse: fix segfault when header path contains whitespace only
When parsing header paths from a patch, we reject any patches with empty
paths as malformed patches. We perform the check whether a path is empty
before sanitizing it, though, which may lead to a path becoming empty
after the check, e.g. if we have trimmed whitespace. This may lead to a
segfault later when any part of our patching logic actually references
such a path, which may then be a `NULL` pointer.
Fix the issue by performing the check after sanitizing. Add tests to
catch the issue as they would have produced a segfault previosuly.
|
|
|
b7dcea04
|
2019-09-26T15:06:12
|
|
config_entries: micro-optimize storage of multivars
Multivars are configuration entries that have many values for the same
name; we can thus micro-optimize this case by just retaining the name of
the first configuration entry and freeing all the others, letting them
point to the string of the first entry.
The attached test case is an extreme example that demonstrates this. It
contains a section name that is approximately 500kB in size with 20.000
entries "a=b". Without the optimization, this would require at least
20000*500kB bytes, which is around 10GB. With this patch, it only
requires 500kB+20000*1B=20500kB.
The obvious culprit here is the section header, which we repeatedly
include in each of the configuration entry's names. This makes it very
easier for an adversary to provide a small configuration file that
disproportionally blows up in memory during processing and is thus a
feasible way for a denial-of-service attack. Unfortunately, we cannot
fix the root cause by e.g. having a separate "section" field that may
easily be deduplicated due to the `git_config_entry` structure being
part of our public API. So this micro-optimization is the best we can do
for now.
|
|
|
82d7a114
|
2019-11-05T11:18:14
|
|
Merge pull request #5293 from csware/config_snapshot-snapshot
Fix crash if snapshotting a config_snapshot
|
|
|
bf2911d7
|
2019-11-02T07:30:32
|
|
Merge pull request #5275 from pks-t/pks/reflogs-with-newlines
reflogs: fix behaviour around reflogs with newlines
|
|
|
dadbb33b
|
2019-11-01T18:55:54
|
|
Fix crash if snapshotting a config_snapshot
Signed-off-by: Sven Strickroth <email@cs-ware.de>
|
|
0974e02f
|
2019-10-30T20:35:48
|
|
commit: add failing tests for object checking for git_commit_with_signature
There can be a significant difference between the system where we created the
buffer (if at all) and when the caller provides us with the contents of a
commit.
Provide some test cases (we have to adapt the existing ones because they refer
to trees and commits which do not exist).
|
|
|
2a7d6de3
|
2019-10-29T07:52:31
|
|
Merge pull request #5276 from pks-t/pks/patch-fuzzing-fixes
patch_parse: fixes for fuzzing errors
|
|
|
a31f4c4b
|
2019-10-24T13:16:03
|
|
Merge pull request #5227 from ddevault/check
apply: add GIT_APPLY_CHECK
|
|
|
c405f231
|
2019-10-24T10:26:43
|
|
Merge pull request #5264 from henkesn/refs-unlock-on-commit
refs: unlock unmodified refs on transaction commit
|
|
02af1fcb
|
2019-09-14T14:03:36
|
|
apply: add GIT_APPLY_CHECK
This adds an option which will check if a diff is applicable without
actually applying it; equivalent to git apply --check.
|
|
|
37141ff7
|
2019-10-21T18:56:59
|
|
patch_parse: detect overflow when calculating old/new line position
When the patch contains lines close to INT_MAX, then it may happen that
we end up with an integer overflow when calculating the line of the
current diff hunk. Reject such patches as unreasonable to avoid the
integer overflow.
As the calculation is performed on integers, we introduce two new
helpers `git__add_int_overflow` and `git__sub_int_overflow` that perform
the integer overflow check in a generic way.
|
|
|
468e3ddc
|
2019-10-19T16:48:11
|
|
patch_parse: fix out-of-bounds read with No-NL lines
We've got two locations where we copy lines into the patch. The first
one is when copying normal " ", "-" or "+" lines, while the second
location gets executed when we copy "\ No newline at end of file" lines.
While the first one correctly uses `git__strndup` to copy only until the
newline, the other one doesn't. Thus, if the line occurs at the end of
the patch and if there is no terminating NUL character, then it may
result in an out-of-bounds read.
Fix the issue by using `git__strndup`, as was already done in the other
location. Furthermore, add allocation checks to both locations to detect
out-of-memory situations.
|