Log

Author Commit Date CI Message
Edward Thomson 9e002cd5 2018-07-21T01:11:58 mbedtls: make ciphers_list a static array Instead of allocating the ciphers_list, make it a static array. This prevents us from leaking it or having to manage its memory.
Edward Thomson 4e62d26f 2018-07-21T00:45:24 mbedtls: free ciphers_list
Edward Thomson defa9709 2018-07-21T00:41:38 mbedtls: check allocations
Edward Thomson d285de73 2018-07-20T21:52:24 push tests: deeply free the specs Don't just free the spec vector, also free the specs themselves.
Edward Thomson dad99881 2018-07-20T21:51:36 push tests: deeply free the push status Don't just free the push status structure, actually free the strings that were strdup'd into the struct as well.
Edward Thomson ca2eb460 2018-07-20T21:50:58 smart subtransport: free url when resetting stream Free the url field when resetting the stream to avoid leaking it.
Patrick Steinhardt ea9e2c1a 2018-07-20T13:06:56 Merge pull request #4692 from tiennou/examples/checkout Add a checkout example
Patrick Steinhardt 0652abaa 2018-07-20T12:56:49 Merge pull request #4702 from tiennou/fix/coverity Assorted Coverity fixes
Patrick Steinhardt fa401a32 2018-07-19T08:20:04 Merge pull request #4704 from nelhage/no-pkt-pack Remove GIT_PKT_PACK entirely
Etienne Samson b24202e1 2018-07-07T12:52:24 examples: add checkout
Edward Thomson 99bb98c0 2018-07-16T11:18:13 Merge pull request #4722 from boogisha/path-is-ignored-git-analogy ignore: improve `git_ignore_path_is_ignored` description Git analogy
Carlos Martín Nieto ee3baed1 2018-07-15T19:28:22 Merge pull request #4724 from libgit2/cmn/allocator-init-order alloc: don't overwrite allocator during init if set
Nelson Elhage 388149f5 2018-07-15T17:25:26 No need for this placeholder.
Carlos Martín Nieto 19007b19 2018-07-15T17:30:04 alloc: don't overwrite allocator during init if set If the allocator has been set before we the library is initialised, we would replace that setting with the standard allocator contrary to the user's wishes.
Edward Thomson 2510268a 2018-07-14T14:00:26 Merge pull request #4700 from pks-t/pks/std-c90 C90 standard compliance
Igor Djordjevic 9cab93c0 2018-07-13T21:29:01 ignore: improve `git_ignore_path_is_ignored` description Git analogy In attempt to provide adequate Git command analogy in regards to ignored files handling, `git_ignore_path_is_ignored` description mentions doing `git add .` on directory containing the file, and whether the file in question would be added or not - but behavior of the two matches for untracked files only, making the comparison misleading in general sense. For tracked files, Git doesn't subject them to ignore rules, so even if a rule applies, `git add .` would actually add the tracked file changes to index, while `git_ignore_path_is_ignored` would still consider the file being ignored (as it doesn't check the index, as documented). Let's provide `git check-ignore --no-index` as analogous Git command example instead, being more aligned with what `git_ignore_path_is_ignored` is about, no matter if the file in question is already tracked or not. See issue #4720 (git_ignore_path_is_ignored documentation misleading?, 2018-07-10)[1] for additional information. [1] https://github.com/libgit2/libgit2/issues/4720
Patrick Steinhardt e1a4a8eb 2018-06-25T11:58:34 cmake: enforce C90 standard While the aim of libgit2 was to conform to C90 code, we never instructed the compiler to enforce C90 compliance. Thus, quite a few violations were able to get into our code base, which have been removed with the previous commits. As we are now able to build libgit2 with C90 enforced, we can set the C_STANDARD property for our own build targets. Note that we explicitly avoid setting the C standard for our third-party dependencies. At least the zlib target does not build with C90 enforced, and we do not want to fix them by deviating from upstream. Thus we simply enforce no standard for them.
Patrick Steinhardt d19381e2 2018-06-25T14:57:07 mbedtls: fix `inline` being used in mbedtls headers The mbedtls headers make direct use of the `inline` attribute to instruct the compiler to inline functions. As this function is not C90 compliant, this can cause the compiler to error as soon as any of these files is included and the `-std=c90` flag is being added. The mbedtls headers declaring functions as inline always have a prelude which define `inline` as a macro in case it is not yet defined. Thus, we can easily replace their define with our own define, which simply copies the logic of our own `GIT_INLINE` macro.
Patrick Steinhardt c13e56f9 2018-06-25T14:12:53 cmake: distinguish internal and system include directories While we want to enforce strict C90 mode, this may cause issues with system provided header files which are themselves not strictly conforming. E.g. if a system header has C++ style comments, a compiler in strict C90 mode would produce an error and abort the build. As the user most likely doesn't want to change the system header, this would completely break the build on such systems. One example of this is mbedtls, which provides such header files. The problem can be worked around by distinguishing between system-provided and project-provided include directories. When adding include directories via "-isystem" instead of "-I", the compiler will skip certain checks and print out less warnings. To use system includes, we can simply add the "SYSTEM" flag to CMake's `INCLUDE_DIRECTORIES` and `TARGET_INCLUDE_DIRECTORIES` functions. Note that we have to split the include directories into two variables because of this, as we definitely still want to check for all warnings produced by our own header files.
Patrick Steinhardt 9994cd3f 2018-06-25T11:56:52 treewide: remove use of C++ style comments C++ style comment ("//") are not specified by the ISO C90 standard and thus do not conform to it. While libgit2 aims to conform to C90, we did not enforce it until now, which is why quite a lot of these non-conforming comments have snuck into our codebase. Do a tree-wide conversion of all C++ style comments to the supported C style comments to allow us enforcing strict C90 compliance in a later commit.
Patrick Steinhardt f347a441 2018-06-25T11:55:13 treewide: avoid use of `inline` attribute ISO C90 does not specify the `inline` attribute, and as such we cannot use it in our code. While we already use `__inline` when building in Microsoft Visual Studio, we should also be using the `__inline__` attribute from GCC/Clang. Otherwise, if we're using neither MSVC nor GCC/Clang, we should simply avoid using `inline` at all and just define functions as static. This commit adjusts our own `GIT_INLINE` macro as well as the inline macros specified by khash and xdiff. This allows us to enable strict C90 mode in a later commit.
Edward Thomson 6dfc8bc2 2018-07-09T23:10:05 Merge pull request #4719 from pks-t/pks/delta-oob Delta OOB access
Edward Thomson 290292b4 2018-07-08T15:28:50 Merge pull request #4710 from pks-t/pks/ssl-init-errors streams: report OpenSSL errors if global init fails
Etienne Samson 5b7ba786 2018-06-23T15:45:04 examples: add a helper for boolean-style options
Etienne Samson 8e063eb6 2018-06-23T15:44:35 examples: make the refish resolution work with short OIDs
Etienne Samson 8a629afe 2018-01-31T00:02:00 examples: move refish resolution function in common
Etienne Samson 698b4463 2018-06-23T13:06:10 annotated_commit: make the refname accessible As git_annotated_commit seems to behave like cgit's refish, it's quite helpful to abstract away "targets" via git_annotated_commit_from_id/from_ref. As the former is accessible via git_annotated_commit_id, make the latter also available to users.
Etienne Samson 89091d36 2018-07-06T20:24:21 tests: fix a relative pathname issue The path given to `git_index_add_bypath` is relative to the root of the repository. That `describe/file` path is relative to the root of the sandbox directory, hence if I add the missing `cl_git_pass` I rightfully get an error that `$SANDBOX/describe/describe/file doesn't exist`. The path is thus changed to be made relative to the repository, which makes the failure go away and "restore" the test.
Etienne Samson 8455a270 2018-07-01T12:04:27 tests: add missing cl_git_pass to tests Reported by Coverity, CID 1393678-1393697.
Etienne Samson 6ae6491e 2018-07-06T22:24:16 smart: don't dereference a NULL pkt pointer By clarifying what detect_caps returns on empty/missing packet, we can be sure there are actually refs to process. The old code could blindly dereference `first`, which might have been NULL. Reported by Coverity, CID 1393614
Etienne Samson 68c7480a 2018-07-06T20:21:25 smart: clarify error handling in git_smart__connect
Etienne Samson 36a5b557 2018-06-19T20:18:26 submodule: don't leak memory when failing to insert the names Reported by Coverity, CID 1393237
Etienne Samson 17bd3b96 2018-06-19T20:15:49 tests: mailmap/parsing: add a missing cl_git_pass Reported by Coverity, CID 1393483
Etienne Samson ca9bbcb5 2018-06-19T20:15:02 blame: check error code when loading the mailmap Reported by Coverity, CID 1393484
Edward Thomson f4633791 2018-07-06T12:36:05 Merge pull request #4687 from tiennou/fix/4672 patch_parse: populate line numbers while parsing diffs
Patrick Steinhardt f2a1cece 2018-07-06T11:25:47 Merge pull request #4686 from tiennou/fix/more-worktree-from-bare Fix git_worktree_validate failing on bare repositories
Patrick Steinhardt 8a00de08 2018-07-06T10:47:06 Merge pull request #4699 from nelhage/fetch-null-dst git_refspec_transform: Handle NULL dst
Patrick Steinhardt 75395c87 2018-06-29T13:35:14 streams: report OpenSSL errors if global init fails In case when the global initialization of the OpenSSL stream fails, the user is left without any hint as to what went wrong as we do not provide any error message at all. This commit refactors the init function to have a common error path, which now also sets an error message including the error string provided by OpenSSL.
Patrick Steinhardt e087c0de 2018-07-05T13:30:46 delta: fix overflow when computing limit When checking whether a delta base offset and length fit into the base we have in memory already, we can trigger an overflow which breaks the check. This would subsequently result in us reading memory from out of bounds of the base. The issue is easily fixed by checking for overflow when adding `off` and `len`, thus guaranteeting that we are never indexing beyond `base_len`. This corresponds to the git patch 8960844a7 (check patch_delta bounds more carefully, 2006-04-07), which adds these overflow checks. Reported-by: Riccardo Schirone <rschiron@redhat.com>
Edward Thomson c43658f6 2018-06-30T13:24:23 Merge pull request #4536 from libgit2/ethomson/index_dirty Add a "dirty" state to the index when it has unsaved changes
Nelson Elhage a73b7c2f 2018-06-29T16:54:06 This error case is now unneeded
Nelson Elhage b8408557 2018-06-29T16:53:23 Merge remote-tracking branch 'origin/master' into no-pkt-pack
Nelson Elhage ff8edac9 2018-06-29T16:18:36 formatting fix
Edward Thomson 243d40df 2018-06-22T19:21:22 docs: add unsaved index safety to changelog
Edward Thomson bfa1f022 2018-06-22T19:17:08 settings: optional unsaved index safety Add the `GIT_OPT_ENABLE_UNSAVED_INDEX_SAFETY` option, which will cause commands that reload the on-disk index to fail if the current `git_index` has changed that have not been saved. This will prevent users from - for example - adding a file to the index then calling a function like `git_checkout` and having that file be silently removed from the index since it was re-read from disk. Now calls that would re-read the index will fail if the index is "dirty", meaning changes have been made to it but have not been written. Users can either `git_index_read` to discard those changes explicitly, or `git_index_write` to write them.
Edward Thomson 787768c2 2018-06-22T19:07:54 index: return a unique error code on dirty index When the index is dirty, return GIT_EINDEXDIRTY so that consumers can identify the exact problem programatically.
Edward Thomson 5e26391a 2018-06-18T18:28:08 checkout: FORCE doesn't halt on dirty index If the index is dirty, allow `GIT_CHECKOUT_FORCE` to obliterate unsaved changes. This is in keeping with its name and description.
Edward Thomson b242cdbf 2017-11-17T00:19:07 index: commit the changes to the index properly Now that the index has a "dirty" state, where it has changes that have not yet been committed or rolled back, our tests need to be adapted to actually commit or rollback the changes instead of assuming that the index can be operated on in its indeterminate state.
Edward Thomson dc4a18c7 2017-11-12T08:23:13 index: test dirty index bit Test that any changes to the index will mark the index as dirty. Also ensure that when we initialize a new index, read the index contents from disk, or write the index contents to disk that we reset the dirty flag to zero. Further ensure that an unforced read with dirty contents (when the on-disk index has not changed) does _not_ reset the dirty flag as we have not updated the contents of our index and our unsaved contents remain intact.
Edward Thomson 7c56c49b 2017-11-12T08:09:35 index: add a dirty bit reflecting unsaved changes Teach the index when it is "dirty", and has unsaved changes. Consider the index dirty whenever a caller has added or removed an entry from the main index, REUC or NAME section, including when the index is completely cleared. Similarly, consider the index _not_ dirty immediately after it is written, or when it is read from the on-disk index. This allows us to ensure that unsaved changes are not lost when we automatically refresh the index.
Edward Thomson 4919e495 2018-02-18T23:55:56 stash: use _an_ index not _the_ index Don't manipulate the repository's index during stash; instead, manipulate a temporary index and check it out. This allows us to use the checkout mechanism to update the workdir and the repository's index, and allows checkout to use its common mechanisms to write data and handle errors.
Edward Thomson 55a96606 2018-06-18T16:14:26 checkout tests: validate GIT_CHECKOUT_NO_REFRESH Add tests that ensure that we re-read the on-disk image by default during checkout, but when the `GIT_CHECKOUT_NO_REFRESH` option is specified, we do _not_ re-read the index.
Etienne Samson 1da6329f 2018-06-29T14:39:17 worktree: don't return "untyped" negative numbers as error codes
Etienne Samson 292a6eca 2018-06-29T14:39:16 worktree: skip building a buffer when validating
Etienne Samson 8356bf7e 2018-06-29T14:39:14 tests: worktree/bare: test some paths
Etienne Samson d0921127 2018-06-29T14:39:13 tests: add a helper to build sandbox subpaths quickly
Etienne Samson 83c35f7e 2018-06-29T14:39:11 tests: worktree/bare: fix git_worktree_validate
Etienne Samson bd40f0d7 2018-06-29T14:39:10 tests: worktree/bare: check git_worktree_list
Etienne Samson 7e3c13e0 2018-06-29T14:39:08 tests: worktree/bare: gather all tests
Edward Thomson 68e73791 2018-06-29T12:52:35 Merge pull request #4709 from pks-t/pks/refspec-dispose refspec: rename `git_refspec__free` to `git_refspec__dispose`
Patrick Steinhardt 01574d40 2018-06-29T11:28:17 Merge pull request #4701 from nikital/master streams: openssl: Handle error in SSL_CTX_new
Patrick Steinhardt af3088e4 2018-06-29T11:45:15 refspec: rename `git_refspec__free` to `git_refspec__dispose` Since commit 630a67366 (refspec: add public parsing api, 2018-02-07), we now have two functions `git_refspec_free` and `git_refspec__free`. The difference is that the first one will free the structure itself, while the second one will only free the structure's contents. Use our new `dispose` naming pattern for the latter function to help avoid confusion.
Patrick Steinhardt 7192e26f 2018-06-29T09:43:33 Merge pull request #4519 from cynecx/refspec-parsing refspec: add public parsing api
Patrick Steinhardt 24597812 2018-06-29T09:11:02 delta: fix out-of-bounds read of delta When computing the offset and length of the delta base, we repeatedly increment the `delta` pointer without checking whether we have advanced past its end already, which can thus result in an out-of-bounds read. Fix this by repeatedly checking whether we have reached the end. Add a test which would cause Valgrind to produce an error. Reported-by: Riccardo Schirone <rschiron@redhat.com> Test-provided-by: Riccardo Schirone <rschiron@redhat.com>
Patrick Steinhardt 7db25870 2018-06-29T07:45:18 delta: fix sign-extension of big left-shift Our delta code was originally adapted from JGit, which itself adapted it from git itself. Due to this heritage, we inherited a bug from git.git in how we compute the delta offset, which was fixed upstream in 48fb7deb5 (Fix big left-shifts of unsigned char, 2009-06-17). As explained by Linus: Shifting 'unsigned char' or 'unsigned short' left can result in sign extension errors, since the C integer promotion rules means that the unsigned char/short will get implicitly promoted to a signed 'int' due to the shift (or due to other operations). This normally doesn't matter, but if you shift things up sufficiently, it will now set the sign bit in 'int', and a subsequent cast to a bigger type (eg 'long' or 'unsigned long') will now sign-extend the value despite the original expression being unsigned. One example of this would be something like unsigned long size; unsigned char c; size += c << 24; where despite all the variables being unsigned, 'c << 24' ends up being a signed entity, and will get sign-extended when then doing the addition in an 'unsigned long' type. Since git uses 'unsigned char' pointers extensively, we actually have this bug in a couple of places. In our delta code, we inherited such a bogus shift when computing the offset at which the delta base is to be found. Due to the sign extension we can end up with an offset where all the bits are set. This can allow an arbitrary memory read, as the addition in `base_len < off + len` can now overflow if `off` has all its bits set. Fix the issue by casting the result of `*delta++ << 24UL` to an unsigned integer again. Add a test with a crafted delta that would actually succeed with an out-of-bounds read in case where the cast wouldn't exist. Reported-by: Riccardo Schirone <rschiron@redhat.com> Test-provided-by: Riccardo Schirone <rschiron@redhat.com>
Nelson Elhage 895a668e 2018-06-28T05:27:36 Small style tweak, and set an error
Edward Thomson 967da2c7 2018-06-27T17:30:12 Merge pull request #4688 from mystor/sorted_revwalk_reset Fix interaction between limited flag and sorting over resets
Edward Thomson 0d1d9e1e 2018-06-27T17:28:40 Merge pull request #4691 from pks-t/pks/http-parser-fallthrough deps: fix implicit fallthrough warning in http-parser
Edward Thomson 12232a5e 2018-06-27T17:19:37 Merge pull request #4698 from nelhage/fix-leaks Fix assorted leaks found via fuzzing
Edward Thomson 88b30f51 2017-11-12T20:50:00 checkout: always set the index in checkout data Always set the `index` in the `checkout_data`, even in the case that we are not reloading the index. Other functionality in checkout examines the index (for example: determining whether the workdir is modified) and we need it even in the (uncommon) case that we are not reloading.
Edward Thomson 7330ae67 2018-06-26T10:45:57 index::addall tests: write the index When running `git_index_add_all`, we should write the index to disk so that we can re-read it safely during status.
Edward Thomson 5dd34702 2018-06-26T09:56:43 Merge branch 'nelhage/smart-no-pack'
Edward Thomson 9286e413 2018-06-26T09:56:06 smart protocol: correct error message capitalization
Edward Thomson 08ea0d7d 2018-02-18T11:49:08 index::reuc tests: test that checkout succeeds The index::reuc tests must test that the checkout itself succeeds, otherwise subsequent tests are not valid. In fact, the checkouts were failing because when checking out `SAFE`, they cannot update the files that are in conflict. Change the checkout level to `FORCE` to ensure that they get updated correctly.
Edward Thomson c4ce017f 2018-02-18T22:27:34 index::names tests: add conflicts with high stages We add entries into the main index to correspond with the NAME entries that we're going to test. NAME entries store the results of conflicts occuring with rename detection during merge, and they must correspond to conflicts in the index. This test was mistakenly adding regular entries. The checkout validation failed, since it requires NAME entries to correspond to high-stage (conflict) entries. Correct the test to actually create conflicts.
Nelson Elhage 90cf8607 2018-06-26T02:32:50 Remove GIT_PKT_PACK entirely
Nikita Leshenko 05d89e72 2018-06-25T17:30:04 streams: openssl: Handle error in SSL_CTX_new SIGSEGV otherwise...
Nelson Elhage 46c9f26f 2018-06-25T15:47:31 Add a test. Verified that this breaks before the fix and passes afterwards.
Nelson Elhage 3a547417 2018-06-25T15:38:29 git_pkt_free: Allow freeing NULL
Patrick Steinhardt e6cdd17c 2018-06-25T13:57:19 Merge pull request #4695 from nelhage/git_pkt-type-confusion Fix type confusion in git_smart__connect
Patrick Steinhardt 983f72c5 2018-06-25T13:52:25 Merge pull request #4696 from nelhage/git_pkt_ref-check-len Verify ref_pkt's are long enough
Nelson Elhage 786c6470 2018-06-25T02:05:21 git_refspec_transform: Handle NULL dst
Nelson Elhage d58afb17 2018-06-24T22:28:37 git_smart__connect: free symrefs on error
Nelson Elhage cf335928 2018-06-24T22:22:40 git_smart__update_heads: free the old symref_target
Nelson Elhage e31c450b 2018-06-24T23:46:36 Fix another missing git_pkt_free
Nelson Elhage bf4c2c57 2018-06-24T21:56:51 wait_while_ack: use git_pkt_free git__free is insufficient if the packet is a git_pkt_ref or another type that requires freeing referenced structures.
Nelson Elhage 437ee5a7 2018-06-24T19:47:08 Verify ref_pkt's are long enough If the remote sends a too-short packet, we'll allow `len` to go negative and eventually issue a malloc for <= 0 bytes on ``` pkt->head.name = git__malloc(alloclen); ```
Nelson Elhage 0098d746 2018-06-24T06:51:31 Fix type confusion in git_smart__connect Nothing verifies that t->refs[0] is a GIT_PKT_REF. A remote can send another packet type, ultimately resulting in a type confusion in `git_smart__detect_caps`
Nelson Elhage 3eec73ae 2018-06-24T20:54:41 PACK packets are illegal while downloading refs
Nika Layzell 4fd81c53 2018-06-18T19:43:53 Clear revwalk sorting when resetting Currently we fail to clear the sorting flag for revwalks when resetting. This caused a poor interaction with the limited flag during a recent patch. This patch clears the revwalk sorting flag and causes it to no longer persist over resets.
Patrick Steinhardt cacbf998 2018-06-22T13:41:17 deps: fix implicit fallthrough warning in http-parser GCC 7 has introduced new warnings for implicit fallthrough in switch statements. Whenever there is no branch in a case block, GCC will watch out for some heuristics which indicate that the implicit fallthrough is intended, like a "fallthrough" comment. The third-party http-parser code manages to trick this heuristic in one case, even though there is a "FALLTHROUGH" comment. Fortunately, GCC has also added a strictness level to the -Wimplicit-fallthrough diagnostic, such that we can loosen this heuristic and make it more lax. Set -Wimplicit-fallthrough=1 in http-parser's CMake build instructions, which is the strictest level that gets rid of the warning. This level will treat any kind of comment as a "fallthrough" comment, which silences the warning.
cynecx 630a6736 2018-02-07T22:30:27 refspec: add public parsing api Fix typo Fix some type issues More fixes Address requested changes Add test Fix naming Fix condition and tests Address requested changes Fix typo
Edward Thomson b121b7ac 2018-06-22T18:28:44 Merge pull request #4411 from pks-t/pks/config-parse-cleanups Config parser cleanups
Patrick Steinhardt e1e90dcc 2018-01-09T14:52:34 config_file: avoid free'ing OOM buffers Buffers which ran out of memory will never have any memory attached to them. As such, it is not necessary to call `git_buf_free` if the buffer is out of memory.
Patrick Steinhardt 83b5f161 2017-11-12T14:09:24 config_parse: always sanitize out-parameters in `parse_variable` The `parse_variable` function has two out parameters `var_name` and `var_value`. Currently, those are not being sanitized to `NULL`. when. any error happens inside of the `parse_variable` function. Fix that. While at it, the coding style is improved to match our usual coding practices more closely.
Patrick Steinhardt e51e29e8 2017-11-12T13:59:47 config_parse: have `git_config_parse` own entry value and name The function `git_config_parse` uses several callbacks to pass data along to the caller as it parses the file. One design shortcoming here is that strings passed to those callbacks are expected to be freed by them, which is really confusing. Fix the issue by changing memory ownership here. Instead of expecting the `on_variable` callbacks to free memory for `git_config_parse`, just do it inside of `git_config_parse`. While this obviously requires a bit more memory allocation churn due to having to copy both name and value at some places, this shouldn't be too much of a burden.
Etienne Samson f9e28026 2018-06-18T20:37:18 patch_parse: populate line numbers while parsing diffs
Edward Thomson e212011b 2018-06-18T12:33:34 Merge pull request #4685 from csware/no-git_buf_free Fix last references to deprecated git_buf_free
Edward Thomson cc9c9522 2018-06-18T12:10:17 Merge pull request #4606 from libgit2/cmn/revwalk-iteration revwalk: avoid walking the entire history when output is unsorted
Sven Strickroth b5818dda 2018-06-18T13:05:08 Fix last references to deprecated git_buf_free Signed-off-by: Sven Strickroth <email@cs-ware.de>