Skip to main content

Browse the archive

swh:1:snp:87728f882295b5ba27035837248a04c5be121c53
sort by:
Revision Author Date Message Commit Date
594730e Junio C Hamano 10 March 2016, 19:13:13 UTC Git 2.7.3 Signed-off-by: Junio C Hamano <gitster@pobox.com> 10 March 2016, 19:14:08 UTC
2e1e569 Junio C Hamano 10 March 2016, 19:13:50 UTC Merge branch 'ma/update-hooks-sample-typofix' into maint * ma/update-hooks-sample-typofix: templates/hooks: fix minor typo in the sample update-hook 10 March 2016, 19:13:50 UTC
3e6e43e Junio C Hamano 10 March 2016, 19:13:49 UTC Merge branch 'dt/initial-ref-xn-commit-doc' into maint * dt/initial-ref-xn-commit-doc: refs: document transaction semantics 10 March 2016, 19:13:49 UTC
4da4026 Junio C Hamano 10 March 2016, 19:13:49 UTC Merge branch 'ps/plug-xdl-merge-leak' into maint * ps/plug-xdl-merge-leak: xdiff/xmerge: fix memory leak in xdl_merge 10 March 2016, 19:13:49 UTC
08e21c9 Junio C Hamano 10 March 2016, 19:13:48 UTC Merge branch 'ak/git-strip-extension-from-dashed-command' into maint Code simplification. * ak/git-strip-extension-from-dashed-command: git.c: simplify stripping extension of a file in handle_builtin() 10 March 2016, 19:13:48 UTC
c6f399c Junio C Hamano 10 March 2016, 19:13:47 UTC Merge branch 'ak/extract-argv0-last-dir-sep' into maint Code simplification. * ak/extract-argv0-last-dir-sep: exec_cmd.c: use find_last_dir_sep() for code simplification 10 March 2016, 19:13:47 UTC
80047fa Junio C Hamano 10 March 2016, 19:13:46 UTC Merge branch 'jk/pack-idx-corruption-safety' into maint The code to read the pack data using the offsets stored in the pack idx file has been made more carefully check the validity of the data in the idx. * jk/pack-idx-corruption-safety: sha1_file.c: mark strings for translation use_pack: handle signed off_t overflow nth_packed_object_offset: bounds-check extended offset t5313: test bounds-checks of corrupted/malicious pack/idx files 10 March 2016, 19:13:46 UTC
0e58b47 Junio C Hamano 10 March 2016, 19:13:45 UTC Merge branch 'js/config-set-in-non-repository' into maint "git config section.var value" to set a value in per-repository configuration file failed when it was run outside any repository, but didn't say the reason correctly. * js/config-set-in-non-repository: git config: report when trying to modify a non-existing repo config 10 March 2016, 19:13:45 UTC
1191d60 Junio C Hamano 10 March 2016, 19:13:45 UTC Merge branch 'sb/submodule-module-list-fix' into maint A helper function "git submodule" uses since v2.7.0 to list the modules that match the pathspec argument given to its subcommands (e.g. "submodule add <repo> <path>") has been fixed. * sb/submodule-module-list-fix: submodule helper list: respect correct path prefix 10 March 2016, 19:13:45 UTC
7f18fad Junio C Hamano 10 March 2016, 19:13:45 UTC Merge branch 'jk/grep-binary-workaround-in-test' into maint Recent versions of GNU grep are pickier when their input contains arbitrary binary data, which some of our tests uses. Rewrite the tests to sidestep the problem. * jk/grep-binary-workaround-in-test: t9200: avoid grep on non-ASCII data t8005: avoid grep on non-ASCII data 10 March 2016, 19:13:45 UTC
d4e7b9b Junio C Hamano 10 March 2016, 19:13:44 UTC Merge branch 'mm/push-simple-doc' into maint The documentation did not clearly state that the 'simple' mode is now the default for "git push" when push.default configuration is not set. * mm/push-simple-doc: Documentation/git-push: document that 'simple' is the default 10 March 2016, 19:13:44 UTC
b7a6ec6 Junio C Hamano 10 March 2016, 19:13:43 UTC Merge branch 'jk/tighten-alloc' into maint * jk/tighten-alloc: (23 commits) compat/mingw: brown paper bag fix for 50a6c8e ewah: convert to REALLOC_ARRAY, etc convert ewah/bitmap code to use xmalloc diff_populate_gitlink: use a strbuf transport_anonymize_url: use xstrfmt git-compat-util: drop mempcpy compat code sequencer: simplify memory allocation of get_message test-path-utils: fix normalize_path_copy output buffer size fetch-pack: simplify add_sought_entry fast-import: simplify allocation in start_packfile write_untracked_extension: use FLEX_ALLOC helper prepare_{git,shell}_cmd: use argv_array use st_add and st_mult for allocation size computation convert trivial cases to FLEX_ARRAY macros use xmallocz to avoid size arithmetic convert trivial cases to ALLOC_ARRAY convert manual allocations to argv_array argv-array: add detach function add helpers for allocating flex-array structs harden REALLOC_ARRAY and xcalloc against size_t overflow ... 10 March 2016, 19:13:43 UTC
aa6c22e Junio C Hamano 10 March 2016, 19:13:42 UTC Merge branch 'jk/more-comments-on-textconv' into maint The memory ownership rule of fill_textconv() API, which was a bit tricky, has been documented a bit better. * jk/more-comments-on-textconv: diff: clarify textconv interface 10 March 2016, 19:13:43 UTC
6044329 Junio C Hamano 10 March 2016, 19:13:41 UTC Merge branch 'jk/no-diff-emit-common' into maint "git merge-tree" used to mishandle "both sides added" conflict with its own "create a fake ancestor file that has the common parts of what both sides have added and do a 3-way merge" logic; this has been updated to use the usual "3-way merge with an empty blob as the fake common ancestor file" approach used in the rest of the system. * jk/no-diff-emit-common: xdiff: drop XDL_EMIT_COMMON merge-tree: drop generate_common strategy merge-one-file: use empty blob for add/add base 10 March 2016, 19:13:42 UTC
28eec80 Junio C Hamano 10 March 2016, 19:13:40 UTC Merge branch 'jc/am-i-v-fix' into maint The "v(iew)" subcommand of the interactive "git am -i" command was broken in 2.6.0 timeframe when the command was rewritten in C. * jc/am-i-v-fix: am -i: fix "v"iew pager: factor out a helper to prepare a child process to run the pager pager: lose a separate argv[] 10 March 2016, 19:13:41 UTC
9c17cca Junio C Hamano 10 March 2016, 19:13:39 UTC Merge branch 'nd/git-common-dir-fix' into maint "git rev-parse --git-common-dir" used in the worktree feature misbehaved when run from a subdirectory. * nd/git-common-dir-fix: rev-parse: take prefix into account in --git-common-dir 10 March 2016, 19:13:40 UTC
8834ea3 Junio C Hamano 10 March 2016, 19:13:39 UTC Merge branch 'nd/dwim-wildcards-as-pathspecs' into maint "git show 'HEAD:Foo[BAR]Baz'" did not interpret the argument as a rev, i.e. the object named by the the pathname with wildcard characters in a tree object. * nd/dwim-wildcards-as-pathspecs: get_sha1: don't die() on bogus search strings check_filename: tighten dwim-wildcard ambiguity checkout: reorder check_filename conditional 10 March 2016, 19:13:39 UTC
fbef03d Junio C Hamano 10 March 2016, 19:13:38 UTC Merge branch 'jk/epipe-in-async' into maint Handling of errors while writing into our internal asynchronous process has been made more robust, which reduces flakiness in our tests. * jk/epipe-in-async: t5504: handle expected output from SIGPIPE death test_must_fail: report number of unexpected signal fetch-pack: ignore SIGPIPE in sideband demuxer write_or_die: handle EPIPE in async threads 10 March 2016, 19:13:38 UTC
2d5ff66 Junio C Hamano 10 March 2016, 19:13:38 UTC Merge branch 'ps/config-error' into maint Many codepaths forget to check return value from git_config_set(); the function is made to die() to make sure we do not proceed when setting a configuration variable failed. * ps/config-error: config: rename git_config_set_or_die to git_config_set config: rename git_config_set to git_config_set_gently compat: die when unable to set core.precomposeunicode sequencer: die on config error when saving replay opts init-db: die on config errors when initializing empty repo clone: die on config error in cmd_clone remote: die on config error when manipulating remotes remote: die on config error when setting/adding branches remote: die on config error when setting URL submodule--helper: die on config error when cloning module submodule: die on config error when linking modules branch: die on config error when editing branch description branch: die on config error when unsetting upstream branch: report errors in tracking branch setup config: introduce set_or_die wrappers 10 March 2016, 19:13:38 UTC
9bb7103 Junio C Hamano 10 March 2016, 19:13:38 UTC Merge branch 'mg/work-tree-tests' into maint Traditionally, the tests that try commands that work on the contents in the working tree were named with "worktree" in their filenames, but with the recent addition of "git worktree" subcommand, whose tests are also named similarly, it has become harder to tell them apart. The traditional tests have been renamed to use "work-tree" instead in an attempt to differentiate them. * mg/work-tree-tests: tests: rename work-tree tests to *work-tree* 10 March 2016, 19:13:38 UTC
33b81b2 Junio C Hamano 10 March 2016, 19:13:37 UTC Merge branch 'sp/remote-curl-ssl-strerror' into maint Help those who debug http(s) part of the system. * sp/remote-curl-ssl-strerror: remote-curl: include curl_errorstr on SSL setup failures 10 March 2016, 19:13:37 UTC
8d5b332 Jeff King 29 February 2016, 10:02:59 UTC compat/mingw: brown paper bag fix for 50a6c8e Commit 50a6c8e (use st_add and st_mult for allocation size computation, 2016-02-22) fixed up many xmalloc call-sites including ones in compat/mingw.c. But I screwed up one of them, which was half-converted to ALLOC_ARRAY, using a very early prototype of the function. And I never caught it because I don't build on Windows. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 29 February 2016, 19:04:23 UTC
7465feb Nguyễn Thái Ngọc Duy 27 February 2016, 07:49:33 UTC sha1_file.c: mark strings for translation Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 27 February 2016, 17:54:57 UTC
43f3afc Jeff King 24 February 2016, 07:48:36 UTC t5504: handle expected output from SIGPIPE death Commit 8bf4bec (add "ok=sigpipe" to test_must_fail and use it to fix flaky tests, 2015-11-27) taught t5504 to handle "git push" racily exiting with SIGPIPE rather than failing. However, one of the tests checks the output of the command, as well. In the SIGPIPE case, we will not have produced any output. If we want the test to be truly non-flaky, we have to accept either output. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 21:51:47 UTC
f3ed0b3 Jeff King 24 February 2016, 07:45:49 UTC test_must_fail: report number of unexpected signal If a command is marked as test_must_fail but dies with a signal, we consider that a problem and report the error to stderr. However, we don't say _which_ signal; knowing that can make debugging easier. Let's share as much as we know. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 21:51:47 UTC
9ff18fa Jeff King 24 February 2016, 07:44:58 UTC fetch-pack: ignore SIGPIPE in sideband demuxer If the other side feeds us a bogus pack, index-pack (or unpack-objects) may die early, before consuming all of its input. As a result, the sideband demuxer may get SIGPIPE (racily, depending on whether our data made it into the pipe buffer or not). If this happens and we are compiled with pthread support, it will take down the main thread, too. This isn't the end of the world, as the main process will just die() anyway when it sees index-pack failed. But it does mean we don't get a chance to say "fatal: index-pack failed" or similar. And it also means that we racily fail t5504, as we sometimes die() and sometimes are killed by SIGPIPE. So let's ignore SIGPIPE while demuxing the sideband. We are already careful to check the return value of write(), so we won't waste time writing to a broken pipe. The caller will notice the error return from the async thread, though in practice we don't even get that far, as we die() as soon as we see that index-pack failed. The non-sideband case is already fine; we let index-pack read straight from the socket, so there is no SIGPIPE at all. Technically the non-threaded async case is also OK without this (the forked async process gets SIGPIPE), but it's not worth distinguishing from the threaded case here. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 21:51:47 UTC
9658846 Jeff King 24 February 2016, 07:40:16 UTC write_or_die: handle EPIPE in async threads When write_or_die() sees EPIPE, it treats it specially by converting it into a SIGPIPE death. We obviously cannot ignore it, as the write has failed and the caller expects us to die. But likewise, we cannot just call die(), because printing any message at all would be a nuisance during normal operations. However, this is a problem if write_or_die() is called from a thread. Our raised signal ends up killing the whole process, when logically we just need to kill the thread (after all, if we are ignoring SIGPIPE, there is good reason to think that the main thread is expecting to handle it). Inside an async thread, the die() code already does the right thing, because we use our custom die_async() routine, which calls pthread_join(). So ideally we would piggy-back on that, and simply call: die_quietly_with_code(141); or similar. But refactoring the die code to do this is surprisingly non-trivial. The die_routines themselves handle both printing and the decision of the exit code. Every one of them would have to be modified to take new parameters for the code, and to tell us to be quiet. Instead, we can just teach write_or_die() to check for the async case and handle it specially. We do have to build an interface to abstract the async exit, but it's simple and self-contained. If we had many call-sites that wanted to do this die_quietly_with_code(), this approach wouldn't scale as well, but we don't. This is the only place where do this weird exit trick. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 21:51:45 UTC
4938686 David Turner 25 February 2016, 20:05:46 UTC refs: document transaction semantics Add some comments on ref transaction semantics to refs.h Signed-off-by: David Turner <dturner@twopensource.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 20:35:31 UTC
13e0b0d Jeff King 25 February 2016, 14:23:26 UTC use_pack: handle signed off_t overflow A v2 pack index file can specify an offset within a packfile of up to 2^64-1 bytes. On a system with a signed 64-bit off_t, we can represent only up to 2^63-1. This means that a corrupted .idx file can end up with a negative offset in the pack code. Our bounds-checking use_pack function looks for too-large offsets, but not for ones that have wrapped around to negative. Let's do so, which fixes an out-of-bounds access demonstrated in t5313. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 19:32:46 UTC
47fe3f6 Jeff King 25 February 2016, 14:22:52 UTC nth_packed_object_offset: bounds-check extended offset If a pack .idx file has a corrupted offset for an object, we may try to access an offset in the .idx or .pack file that is larger than the file's size. For the .pack case, we have use_pack() to protect us, which realizes the access is out of bounds. But if the corrupted value asks us to look in the .idx file's secondary 64-bit offset table, we blindly add it to the mmap'd index data and access arbitrary memory. We can fix this with a simple bounds-check compared to the size we found when we opened the .idx file. Note that there's similar code in index-pack that is triggered only during "index-pack --verify". To support both, we pull the bounds-check into a separate function, which dies when it sees a corrupted file. It would be nice if we could return an error, so that the pack code could try to find a good copy of the object elsewhere. Currently nth_packed_object_offset doesn't have any way to return an error, but it could probably use "0" as a sentinel value (since no object can start there). This is the minimal fix, and we can improve the resilience later on top. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 19:32:43 UTC
a128386 Jeff King 25 February 2016, 14:21:12 UTC t5313: test bounds-checks of corrupted/malicious pack/idx files Our on-disk .pack and .idx files may reference other data by offset. We should make sure that we are not fooled by corrupt data into accessing memory outside of our mmap'd boundaries. This patch adds a series of tests for offsets found in .pack and .idx files. For the most part we get this right, but there are two tests of .idx files marked as failures: we do not bounds-check offsets in the v2 index's extended offset table, nor do we handle .idx offsets that overflow a signed off_t. With these tests, we should have good coverage of all offsets found in these files. Note that this doesn't cover .bitmap files, which may have similar bugs. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 19:32:41 UTC
638fa62 Johannes Schindelin 24 February 2016, 12:48:11 UTC git config: report when trying to modify a non-existing repo config It is a pilot error to call `git config section.key value` outside of any Git worktree. The message error: could not lock config file .git/config: No such file or directory is not very helpful in that situation, though. Let's print a helpful message instead. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 18:52:32 UTC
9537f21 Martin Amdisen 25 February 2016, 08:10:12 UTC templates/hooks: fix minor typo in the sample update-hook Signed-off-by: Martin Mosegaard Amdisen <martin.amdisen@praqma.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 25 February 2016, 17:32:20 UTC
2b56bb7 Stefan Beller 24 February 2016, 21:15:02 UTC submodule helper list: respect correct path prefix This is a regression introduced by 74703a1e4d (submodule: rewrite `module_list` shell function in C, 2015-09-02). Add a test to ensure we list the right submodule when giving a specific pathspec. Reported-By: Caleb Jorden <cjorden@gmail.com> Signed-off-by: Stefan Beller <sbeller@google.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 24 February 2016, 22:33:02 UTC
3b1442d John Keeping 21 February 2016, 17:32:22 UTC t9200: avoid grep on non-ASCII data GNU grep 2.23 detects the input used in this test as binary data so it does not work for extracting lines from a file. We could add the "-a" option to force grep to treat the input as text, but not all implementations support that. Instead, use sed to extract the desired lines since it will always treat its input as text. Signed-off-by: John Keeping <john@keeping.me.uk> Signed-off-by: Junio C Hamano <gitster@pobox.com> 23 February 2016, 23:03:43 UTC
0be43de John Keeping 21 February 2016, 17:32:21 UTC t8005: avoid grep on non-ASCII data GNU grep 2.23 detects the input used in this test as binary data so it does not work for extracting lines from a file. We could add the "-a" option to force grep to treat the input as text, but not all implementations support that. Instead, use sed to extract the desired lines since it will always treat its input as text. While touching these lines, modernize the test style to avoid hiding the exit status of "git blame" and remove a space following a redirection operator. Also swap the order of the expected and actual output files given to test_cmp; we compare expect and actual to show how actual output differs from what is expected. Signed-off-by: John Keeping <john@keeping.me.uk> Signed-off-by: Junio C Hamano <gitster@pobox.com> 23 February 2016, 23:00:12 UTC
f6b1fb3 Matthieu Moy 23 February 2016, 21:04:41 UTC Documentation/git-push: document that 'simple' is the default The default behavior is well documented already in git-config(1), but git-push(1) itself did not mention it at all. For users willing to learn how "git push" works but not how to configure it, this makes the documentation cumbersome to read. Make the git-push(1) page self-contained by adding a short summary of what 'push.default=simple' does, early in the page. Signed-off-by: Matthieu Moy <Matthieu.Moy@imag.fr> Signed-off-by: Junio C Hamano <gitster@pobox.com> 23 February 2016, 21:35:10 UTC
4867f11 Patrick Steinhardt 23 February 2016, 11:59:17 UTC xdiff/xmerge: fix memory leak in xdl_merge When building the script for the second file that is to be merged we have already allocated memory for data structures related to the first file. When we encounter an error in building the second script we only free allocated memory related to the second file before erroring out. Fix this memory leak by also releasing allocated memory related to the first file. Helped-by: Johannes Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 23 February 2016, 20:58:26 UTC
907681e Jeff King 23 February 2016, 06:07:25 UTC xdiff: drop XDL_EMIT_COMMON There are no more callers that use this mode, and none likely to be added (as our xdl_merge() eliminates the common use of it for generating 3-way merge bases). This is effectively a revert of a9ed376 (xdiff: generate "anti-diffs" aka what is common to two files, 2006-06-28), though of course trying to revert that ancient commit directly produces many textual conflicts. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 23 February 2016, 06:36:09 UTC
b779b3a Jeff King 23 February 2016, 06:06:55 UTC merge-tree: drop generate_common strategy When merge_blobs sees an add/add conflict, it tries to create a virtual base object for the 3-way merge that consists of the common lines of each file. It inherited this strategy from merge-one-file in 0c79938 (Improved three-way blob merging code, 2006-06-28), and the point is to minimize the size of the conflict hunks. That commit talks about "if libxdiff were to ever grow a compatible three-way merge, it could probably be directly plugged in". That has long since happened. So as with merge-one-file in the previous commit, this extra step is no longer necessary. Our 3-way merge code is smart enough to do the minimizing itself if we simply feed it an empty base, which is what the more modern merge-recursive strategy already does. Not only does this let us drop some code, but it removes an overflow bug in generate_common_file(). We allocate a buffer as large as the smallest of the two blobs, under the assumption that there cannot be more common content than what is in the smaller blob. However, xdiff may feed us more: if neither file ends in a newline, it feeds us the "\nNo newline at end of file" marker as common content, and we write it into the output. If the differences between the files are small than that string, we overflow the output buffer. This patch solves it by simply dropping the buggy code entirely. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 23 February 2016, 06:36:07 UTC
1a92e53 Jeff King 23 February 2016, 06:04:41 UTC merge-one-file: use empty blob for add/add base When we see an add/add conflict on a file, we generate the conflicted content by doing a 3-way merge with a "virtual" base consisting of the common lines of the two sides. This strategy dates back to cb93c19 (merge-one-file: use common as base, instead of emptiness., 2005-11-09). Back then, the next step was to call rcs merge to generate the 3-way conflicts. Using the virtual base produced much better results, as rcs merge does not attempt to minimize the hunks. As a result, you'd get a conflict with the entirety of the files on either side. Since then, though, we've switched to using git-merge-file, which uses xdiff's "zealous" merge. This will find the minimal hunks even with just the simple, empty base. Let's switch to using that empty base. It's simpler, more efficient, and reduces our dependencies (we no longer need a working diff binary). It's also how the merge-recursive strategy handles this same case. We can almost get rid of git-sh-setup's create_virtual_base, but we don't here, for two reasons: 1. The functions in git-sh-setup are part of our public interface, so it's possible somebody is depending on it. We'd at least need to deprecate it first. 2. It's also used by mergetool's p4merge driver. It's unknown whether its 3-way merge is as capable as git's; if not, then it is benefiting from the function. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 23 February 2016, 06:36:05 UTC
08c95df Jeff King 22 February 2016, 22:45:15 UTC ewah: convert to REALLOC_ARRAY, etc Now that we're built around xmalloc and friends, we can use helpers like REALLOC_ARRAY, ALLOC_GROW, and so on to make the code shorter and protect against integer overflow. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
fb7dbf3 Jeff King 22 February 2016, 22:45:12 UTC convert ewah/bitmap code to use xmalloc This code was originally written with the idea that it could be spun off into its own ewah library, and uses the overrideable ewah_malloc to do allocations. We plug in xmalloc as our ewah_malloc, of course. But over the years the ewah code itself has become more entangled with git, and the return value of many ewah_malloc sites is not checked. Let's just drop the level of indirection and use xmalloc and friends directly. This saves a few lines, and will let us adapt these sites to our more advanced malloc helpers. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
b1ddfb9 Jeff King 22 February 2016, 22:45:08 UTC diff_populate_gitlink: use a strbuf We allocate 100 bytes to hold the "Submodule commit ..." text. This is enough, but it's not immediately obvious that this is the case, and we have to repeat the magic 100 twice. We could get away with xstrfmt here, but we want to know the size, as well, so let's use a real strbuf. And while we're here, we can clean up the logic around size_only. It currently sets and clears the "data" field pointlessly, and leaves the "should_free" flag on even after we have cleared the data. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
21f9d0f Jeff King 22 February 2016, 22:45:05 UTC transport_anonymize_url: use xstrfmt This function uses xcalloc and two memcpy calls to concatenate two strings. We can do this as an xstrfmt one-liner, and then it is more clear that we are allocating the correct amount of memory. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
7eb45b5 Jeff King 22 February 2016, 22:45:01 UTC git-compat-util: drop mempcpy compat code There are no callers of this left, as the last one was dropped in the previous patch. And there are not likely to be new ones, as the function has been around since 2010 without gaining any new callers. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
7b35eaf Jeff King 22 February 2016, 22:44:57 UTC sequencer: simplify memory allocation of get_message For a commit with sha1 "1234abcd" and subject "foo", this function produces a struct with three strings: 1. "foo" 2. "1234abcd... foo" 3. "parent of 1234abcd... foo" It takes advantage of the fact that these strings are subsets of each other, and allocates only _one_ string, with pointers into the various parts. Unfortunately, this makes the string allocation complicated and hard to follow. Since we keep only one of these in memory at a time, we can afford to simply allocate three strings. This lets us build on tools like xstrfmt and avoid manual computation. While we're here, we can also drop the ad-hoc reimplementation of get_git_commit_encoding(), and simply call that function. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
62f1751 Jeff King 22 February 2016, 22:44:54 UTC test-path-utils: fix normalize_path_copy output buffer size The normalize_path_copy function needs an output buffer that is at least as long as its input (it may shrink the path, but never expand it). However, this test program feeds it static PATH_MAX-sized buffers, which have no relation to the input size. In the normalize_ceiling_entry case, we do at least check the size against PATH_MAX and die(), but that case is even more convoluted. We normalize into a fixed-size buffer, free the original, and then replace it with a strdup'd copy of the result. But normalize_path_copy explicitly allows normalizing in-place, so we can simply do that. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
5545f05 Jeff King 22 February 2016, 22:44:50 UTC fetch-pack: simplify add_sought_entry We have two variants of this function, one that takes a string and one that takes a ptr/len combo. But we only call the latter with the length of a NUL-terminated string, so our first simplification is to drop it in favor of the string variant. Since we know we have a string, we can also replace the manual memory computation with a call to alloc_ref(). Furthermore, we can rely on get_oid_hex() to complain if it hits the end of the string. That means we can simplify the check for "<sha1> <ref>" versus just "<ref>". Rather than manage the ptr/len pair, we can just bump the start of our string forward. The original code over-allocated based on the original "namelen" (which wasn't _wrong_, but was simply wasteful and confusing). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
a78c188 Jeff King 22 February 2016, 22:44:46 UTC fast-import: simplify allocation in start_packfile This function allocate a packed_git flex-array, and adds a mysterious 2 bytes to the length of the pack_name field. One is for the trailing NUL, but the other has no purpose. This is probably cargo-culted from add_packed_git, which gets the ".idx" path and needed to allocate enough space to hold the matching ".pack" (though since 48bcc1c, we calculate the size there differently). This site, however, is using the raw path of a tempfile, and does not need the extra byte. We can just replace the allocation with FLEX_ALLOC_STR, which handles the allocation and the NUL for us. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
e0b8373 Jeff King 22 February 2016, 22:44:42 UTC write_untracked_extension: use FLEX_ALLOC helper We perform unchecked additions when computing the size of a "struct ondisk_untracked_cache". This is unlikely to have an integer overflow in practice, but we'd like to avoid this dangerous pattern to make further audits easier. Note that there's one subtlety here, though. We protect ourselves against a NULL exclude_per_dir entry in our source, and avoid calling strlen() on it, keeping "len" at 0. But later, we unconditionally memcpy "len + 1" bytes to get the trailing NUL byte. If we did have a NULL exclude_per_dir, we would read from bogus memory. As it turns out, though, we always create this field pointing to a string literal, so there's no bug. We can just get rid of the pointless extra conditional. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
20574f5 Jeff King 22 February 2016, 22:44:39 UTC prepare_{git,shell}_cmd: use argv_array These functions transform an existing argv into one suitable for exec-ing or spawning via git or a shell. We can use an argv_array in each to avoid dealing with manual counting and allocation. This also makes the memory allocation more clear and fixes some leaks. In prepare_shell_cmd, we would sometimes allocate a new string with "$@" in it and sometimes not, meaning the caller could not correctly free it. On the non-Windows side, we are in a child process which will exec() or exit() immediately, so the leak isn't a big deal. On Windows, though, we use spawn() from the parent process, and leak a string for each shell command we run. On top of that, the Windows code did not free the allocated argv array at all (but does for the prepare_git_cmd case!). By switching both of these functions to write into an argv_array, we can consistently free the result as appropriate. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
50a6c8e Jeff King 22 February 2016, 22:44:35 UTC use st_add and st_mult for allocation size computation If our size computation overflows size_t, we may allocate a much smaller buffer than we expected and overflow it. It's probably impossible to trigger an overflow in most of these sites in practice, but it is easy enough convert their additions and multiplications into overflow-checking variants. This may be fixing real bugs, and it makes auditing the code easier. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
96ffc06 Jeff King 22 February 2016, 22:44:32 UTC convert trivial cases to FLEX_ARRAY macros Using FLEX_ARRAY macros reduces the amount of manual computation size we have to do. It also ensures we don't overflow size_t, and it makes sure we write the same number of bytes that we allocated. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
3733e69 Jeff King 22 February 2016, 22:44:28 UTC use xmallocz to avoid size arithmetic We frequently allocate strings as xmalloc(len + 1), where the extra 1 is for the NUL terminator. This can be done more simply with xmallocz, which also checks for integer overflow. There's no case where switching xmalloc(n+1) to xmallocz(n) is wrong; the result is the same length, and malloc made no guarantees about what was in the buffer anyway. But in some cases, we can stop manually placing NUL at the end of the allocated buffer. But that's only safe if it's clear that the contents will always fill the buffer. In each case where this patch does so, I manually examined the control flow, and I tried to err on the side of caution. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
b32fa95 Jeff King 22 February 2016, 22:44:25 UTC convert trivial cases to ALLOC_ARRAY Each of these cases can be converted to use ALLOC_ARRAY or REALLOC_ARRAY, which has two advantages: 1. It automatically checks the array-size multiplication for overflow. 2. It always uses sizeof(*array) for the element-size, so that it can never go out of sync with the declared type of the array. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:51:09 UTC
850d2fe Jeff King 22 February 2016, 22:44:21 UTC convert manual allocations to argv_array There are many manual argv allocations that predate the argv_array API. Switching to that API brings a few advantages: 1. We no longer have to manually compute the correct final array size (so it's one less thing we can screw up). 2. In many cases we had to make a separate pass to count, then allocate, then fill in the array. Now we can do it in one pass, making the code shorter and easier to follow. 3. argv_array handles memory ownership for us, making it more obvious when things should be free()d and and when not. Most of these cases are pretty straightforward. In some, we switch from "run_command_v" to "run_command" which lets us directly use the argv_array embedded in "struct child_process". Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:50:32 UTC
b992657 Jeff King 22 February 2016, 22:44:15 UTC argv-array: add detach function The usual pattern for an argv array is to initialize it, push in some strings, and then clear it when done. Very occasionally, though, we must do other exotic things with the memory, like freeing the list but keeping the strings. Let's provide a detach function so that callers can make use of our API to build up the array, and then take ownership of it. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:50:32 UTC
3689539 Jeff King 22 February 2016, 22:43:25 UTC add helpers for allocating flex-array structs Allocating a struct with a flex array is pretty simple in practice: you over-allocate the struct, then copy some data into the over-allocation. But it can be a slight pain to make sure you're allocating and copying the right amounts. This patch adds a few helpers to turn simple cases of flex-array struct allocation into a one-liner that properly checks for overflow. See the embedded documentation for details. Ideally we could provide a more flexible version that could handle multiple strings, like: FLEX_ALLOC_FMT(ref, name, "%s%s", prefix, name); But we have to implement this as a macro (because of the offset calculation of the flex member), which means we would need all compilers to support variadic macros. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:50:32 UTC
e7792a7 Jeff King 22 February 2016, 22:43:18 UTC harden REALLOC_ARRAY and xcalloc against size_t overflow REALLOC_ARRAY inherently involves a multiplication which can overflow size_t, resulting in a much smaller buffer than we think we've allocated. We can easily harden it by using st_mult() to check for overflow. Likewise, we can add ALLOC_ARRAY to do the same thing for xmalloc calls. xcalloc() should already be fine, because it takes the two factors separately, assuming the system calloc actually checks for overflow. However, before we even hit the system calloc(), we do our memory_limit_check, which involves a multiplication. Let's check for overflow ourselves so that this limit cannot be bypassed. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 22:50:32 UTC
326e5bc Junio C Hamano 22 February 2016, 21:12:56 UTC Git 2.7.2 Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 21:12:56 UTC
2bbea5c Junio C Hamano 22 February 2016, 21:10:21 UTC Merge branch 'nd/ita-cleanup' into maint Paths that have been told the index about with "add -N" are not quite yet in the index, but a few commands behaved as if they already are in a harmful way. * nd/ita-cleanup: grep: make it clear i-t-a entries are ignored add and use a convenience macro ce_intent_to_add() blame: remove obsolete comment 22 February 2016, 21:10:21 UTC
47847c7 Junio C Hamano 22 February 2016, 21:10:20 UTC Merge branch 'pw/completion-stash' into maint * pw/completion-stash: completion: fix mis-indentation in _git_stash() 22 February 2016, 21:10:20 UTC
924459c Junio C Hamano 22 February 2016, 21:10:20 UTC Merge branch 'mm/clean-doc-fix' into maint The documentation for "git clean" has been corrected; it mentioned that .git/modules/* are removed by giving two "-f", which has never been the case. * mm/clean-doc-fix: Documentation/git-clean.txt: don't mention deletion of .git/modules/* 22 February 2016, 21:10:20 UTC
2263a05 Junio C Hamano 22 February 2016, 21:10:19 UTC Merge branch 'dw/mergetool-vim-window-shuffle' into maint The vimdiff backend for "git mergetool" has been tweaked to arrange and number buffers in the order that would match the expectation of majority of people who read left to right, then top down and assign buffers 1 2 3 4 "mentally" to local base remote merge windows based on that order. * dw/mergetool-vim-window-shuffle: mergetool: reorder vim/gvim buffers in three-way diffs 22 February 2016, 21:10:20 UTC
fa7b63d Junio C Hamano 22 February 2016, 21:10:19 UTC Merge branch 'ah/stripspace-optstring' into maint * ah/stripspace-optstring: stripspace: call U+0020 a "space" instead of a "blank" 22 February 2016, 21:10:19 UTC
a64e6a4 Jeff King 22 February 2016, 18:28:54 UTC diff: clarify textconv interface The memory allocation scheme for the textconv interface is a bit tricky, and not well documented. It was originally designed as an internal part of diff.c (matching fill_mmfile), but gradually was made public. Refactoring it is difficult, but we can at least improve the situation by documenting the intended flow and enforcing it with an in-code assertion. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:40:35 UTC
59305ae SZEDER Gábor 22 February 2016, 13:02:50 UTC completion: fix mis-indentation in _git_stash() Signed-off-by: SZEDER Gábor <szeder@ira.uka.de> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:26:04 UTC
3d18064 Patrick Steinhardt 22 February 2016, 11:23:36 UTC config: rename git_config_set_or_die to git_config_set Rename git_config_set_or_die functions to git_config_set, leading to the new default behavior of dying whenever a configuration error occurs. By now all callers that shall die on error have been transitioned to the _or_die variants, thus making this patch a simple rename of the functions. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:55 UTC
30598ad Patrick Steinhardt 22 February 2016, 11:23:35 UTC config: rename git_config_set to git_config_set_gently The desired default behavior for `git_config_set` is to die whenever an error occurs. Dying is the default for a lot of internal functions when failures occur and is in this case the right thing to do for most callers as otherwise we might run into inconsistent repositories without noticing. As some code may rely on the actual return values for `git_config_set` we still require the ability to invoke these functions without aborting. Rename the existing `git_config_set` functions to `git_config_set_gently` to keep them available for those callers. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:55 UTC
2f29c1b Patrick Steinhardt 22 February 2016, 11:23:34 UTC compat: die when unable to set core.precomposeunicode When calling `git_config_set` to set 'core.precomposeunicode' we ignore the return value of the function, which may indicate that we were unable to write the value back to disk. As the function is only called by init-db we can and should die when an error occurs. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:54 UTC
6c24dfb Patrick Steinhardt 22 February 2016, 11:23:33 UTC sequencer: die on config error when saving replay opts When we start picking a range of revisions we save the replay options that are required to restore state when interrupting and later continuing picking the revisions. However, we do not check the return values of the `git_config_set` functions, which may lead us to store incomplete information. As this may lead us to fail when trying to continue the sequence the error can be fatal. Fix this by dying immediately when we are unable to write back any replay option. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:54 UTC
695009b Patrick Steinhardt 22 February 2016, 11:23:32 UTC init-db: die on config errors when initializing empty repo When creating an empty repository with `git init-db` we do not check for error codes returned by `git_config_set` functions. This may cause the user to end up with an inconsistent repository without any indication for the user. Fix this problem by dying early with an error message when we are unable to write the configuration files to disk. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:54 UTC
2ee35c4 Patrick Steinhardt 22 February 2016, 11:23:31 UTC clone: die on config error in cmd_clone The clone command does not check for error codes returned by `git_config_set` functions. This may cause the user to end up with an inconsistent repository without any indication with what went wrong. Fix this problem by dying with an error message when we are unable to write the configuration files to disk. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:53 UTC
c397deb Patrick Steinhardt 22 February 2016, 11:23:30 UTC remote: die on config error when manipulating remotes When manipulating remotes we try to set various configuration values without checking if the values were persisted correctly, possibly leaving the remote in an inconsistent state. Fix this issue by dying early and notifying the user about the error. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:53 UTC
ab5e4b6 Patrick Steinhardt 22 February 2016, 11:23:29 UTC remote: die on config error when setting/adding branches When we add or set new branches (e.g. by `git remote add -f` or `git remote set-branches`) we do not check for error codes when writing the branches to the configuration file. When persisting the configuration failed we are left with a remote that has none or not all of the branches that should have been set without notifying the user. Fix this issue by dying early on configuration error. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:53 UTC
45ebdcc Patrick Steinhardt 22 February 2016, 11:23:28 UTC remote: die on config error when setting URL When invoking `git-remote --set-url` we do not check the return value when writing the actual new URL to the configuration file, pretending to the user that the configuration has been set while it was in fact not persisted. Fix this problem by dying early when setting the config fails. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:52 UTC
15b92fc Patrick Steinhardt 22 February 2016, 11:23:27 UTC submodule--helper: die on config error when cloning module When setting the 'core.worktree' option for a newly cloned submodule we ignore the return value of `git_config_set_in_file`. As this leaves the submodule in an inconsistent state, we instead want to inform the user that something has gone wrong by printing an error and aborting the program. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:52 UTC
1a90dfe Patrick Steinhardt 22 February 2016, 11:23:26 UTC submodule: die on config error when linking modules When trying to connect a submodule with its corresponding repository in '.git/modules' we try to set the core.worktree setting in the submodule, which may fail due to an error encountered in `git_config_set_in_file`. The function is used in the git-mv command when trying to move a submodule to another location. We already die when renaming a file fails but do not pay attention to the case where updating the connection between submodule and its repository fails. As this leaves the repository in an inconsistent state, as well, abort the program by dying early and presenting the failure to the user. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:52 UTC
bd25f89 Patrick Steinhardt 22 February 2016, 11:23:25 UTC branch: die on config error when editing branch description Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:52 UTC
b81842c Patrick Steinhardt 22 February 2016, 11:23:24 UTC branch: die on config error when unsetting upstream When we try to unset upstream configurations we do not check return codes for the `git_config_set` functions. As those may indicate that we were unable to unset the respective configuration we may exit successfully without any error message while in fact the upstream configuration was not unset. Fix this by dying with an error message when we cannot unset the configuration. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:45 UTC
27852b2 Patrick Steinhardt 22 February 2016, 11:23:23 UTC branch: report errors in tracking branch setup When setting up a new tracking branch fails due to issues with the configuration file we do not report any errors to the user and pretend setting the tracking branch succeeded. Setting up the tracking branch is handled by the `install_branch_config` function. We do not want to simply die there as the function is not only invoked when explicitly setting upstream information with `git branch --set-upstream-to=`, but also by `git push --set-upstream` and `git clone`. While it is reasonable to die in the explict first case, we would lose information in the latter two cases, so we only print the error message but continue the program as usual. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 18:23:30 UTC
63ca1c0 Alexander Kuleshov 22 February 2016, 07:18:29 UTC git.c: simplify stripping extension of a file in handle_builtin() The handle_builtin() starts from stripping of command extension if STRIP_EXTENSION is enabled. Actually STRIP_EXTENSION does not used anywhere else. This patch introduces strip_extension() helper to strip STRIP_EXTENSION extension from argv[0] with the strip_suffix() instead of manually stripping. Signed-off-by: Alexander Kuleshov <kuleshovmail@gmail.com> Helped-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 22 February 2016, 07:52:43 UTC
5549029 Michael J Gruber 20 February 2016, 16:18:41 UTC tests: rename work-tree tests to *work-tree* "Work tree" or "working tree" is the name of a checked out tree, "worktree" the name of the command which manages several working trees. The naming of tests mixes these two, currently: $ls t/*worktree* t/t1501-worktree.sh t/t1509-root-worktree.sh t/t2025-worktree-add.sh t/t2026-worktree-prune.sh t/t2027-worktree-list.sh t/t2104-update-index-skip-worktree.sh t/t3320-notes-merge-worktrees.sh t/t7011-skip-worktree-reading.sh t/t7012-skip-worktree-writing.sh t/t7409-submodule-detached-worktree.sh $grep -l "git worktree" t/*.sh t/t0002-gitfile.sh t/t1400-update-ref.sh t/t2025-worktree-add.sh t/t2026-worktree-prune.sh t/t2027-worktree-list.sh t/t3320-notes-merge-worktrees.sh t/t7410-submodule-checkout-to.sh Rename t1501, t1509 and t7409 to make it clear on first glance that they test work tree related behavior, rather than the worktree command. t2104, t7011 and t7012 are about the "skip-worktree" flag so that their name should remain unchanged. Signed-off-by: Michael J Gruber <git@drmicha.warpmail.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 21 February 2016, 07:37:29 UTC
f459823 Alexander Kuleshov 19 February 2016, 08:44:48 UTC exec_cmd.c: use find_last_dir_sep() for code simplification We are trying to extract dirname from argv0 in the git_extract_argv0_path(). But in the same time, the <git-compat-util.h> provides find_last_dir_sep() to get dirname from a given path. Let's use it instead of loop for the code simplification. Signed-off-by: Alexander Kuleshov <kuleshovmail@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 19 February 2016, 21:26:38 UTC
5b442c4 Jeff King 19 February 2016, 11:21:30 UTC tree-diff: catch integer overflow in combine_diff_path allocation A combine_diff_path struct has two "flex" members allocated alongside the struct: a string to hold the pathname, and an array of parent pointers. We use an "int" to compute this, meaning we may easily overflow it if the pathname is extremely long. We can fix this by using size_t, and checking for overflow with the st_add helper. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 19 February 2016, 17:40:37 UTC
320d0b4 Jeff King 19 February 2016, 11:21:19 UTC add helpers for detecting size_t overflow Performing computations on size_t variables that we feed to xmalloc and friends can be dangerous, as an integer overflow can cause us to allocate a much smaller chunk than we realized. We already have unsigned_add_overflows(), but let's add unsigned_mult_overflows() to that. Furthermore, rather than have each site manually check and die on overflow, we can provide some helpers that will: - promote the arguments to size_t, so that we know we are doing our computation in the same size of integer that will ultimately be fed to xmalloc - check and die on overflow - return the result so that computations can be done in the parameter list of xmalloc. These functions are a lot uglier to use than normal arithmetic operators (you have to do "st_add(foo, bar)" instead of "foo + bar"). To at least limit the damage, we also provide multi-valued versions. So rather than: st_add(st_add(a, b), st_add(c, d)); you can write: st_add4(a, b, c, d); This isn't nearly as elegant as a varargs function, but it's a lot harder to get it wrong. You don't have to remember to add a sentinel value at the end, and the compiler will complain if you get the number of arguments wrong. This patch adds only the numbered variants required to convert the current code base; we can easily add more later if needed. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 19 February 2016, 17:40:37 UTC
c3a700f Jeff King 19 February 2016, 11:21:08 UTC reflog_expire_cfg: NUL-terminate pattern field You can tweak the reflog expiration for a particular subset of refs by configuring gc.foo.reflogexpire. We keep a linked list of reflog_expire_cfg structs, each of which holds the pattern and a "len" field for the length of the pattern. The pattern itself is _not_ NUL-terminated. However, we feed the pattern directly to wildmatch(), which expects a NUL-terminated string, meaning it may keep reading random junk after our struct. We can fix this by allocating an extra byte for the NUL (which is already zero because we use xcalloc). Let's also drop the misleading "len" field, which is no longer necessary. The existing use of "len" can be converted to use strncmp(). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com> 19 February 2016, 17:40:37 UTC
8a71d90 Junio C Hamano 17 February 2016, 18:05:44 UTC Start preparing for 2.7.2 Signed-off-by: Junio C Hamano <gitster@pobox.com> 17 February 2016, 18:05:44 UTC
7516977 Junio C Hamano 17 February 2016, 18:03:41 UTC Merge branch 'js/test-lib-windows-emulated-yes' into maint The emulated "yes" command used in our test scripts has been tweaked not to spend too much time generating unnecessary output that is not used, to help those who test on Windows where it would not stop until it fills the pipe buffer due to lack of SIGPIPE. * js/test-lib-windows-emulated-yes: test-lib: limit the output of the yes utility 17 February 2016, 18:03:41 UTC
0eefe10 Junio C Hamano 17 February 2016, 18:03:40 UTC Merge branch 'aw/push-force-with-lease-reporting' into maint "git push --force-with-lease" has been taught to report if the push needed to force (or fast-forwarded). * aw/push-force-with-lease-reporting: push: fix ref status reporting for --force-with-lease 17 February 2016, 18:03:40 UTC
88221d9 Junio C Hamano 17 February 2016, 18:03:40 UTC Merge branch 'nd/do-not-move-worktree-manually' into maint "git worktree" had a broken code that attempted to auto-fix possible inconsistency that results from end-users moving a worktree to different places without telling Git (the original repository needs to maintain backpointers to its worktrees, but "mv" run by end-users who are not familiar with that fact will obviously not adjust them), which actually made things worse when triggered. * nd/do-not-move-worktree-manually: worktree: stop supporting moving worktrees manually worktree.c: fix indentation 17 February 2016, 18:03:40 UTC
ab2c107 Junio C Hamano 17 February 2016, 18:03:39 UTC Merge branch 'js/xmerge-marker-eol' into maint The low-level merge machinery has been taught to use CRLF line termination when inserting conflict markers to merged contents that are themselves CRLF line-terminated. * js/xmerge-marker-eol: merge-file: ensure that conflict sections match eol style merge-file: let conflict markers match end-of-line style of the context 17 February 2016, 18:03:39 UTC
527d4a6 GyuYong Jung 17 February 2016, 02:14:58 UTC git-cvsserver.perl: fix typo Signed-off-by: GyuYong Jung <obliviscence@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 17 February 2016, 18:00:53 UTC
708b8cc Junio C Hamano 16 February 2016, 22:46:39 UTC am -i: fix "v"iew The 'v'iew subcommand of the interactive mode of "git am -i" was broken by the rewrite to C we did at around 2.6.0 timeframe at 7ff26832 (builtin-am: implement -i/--interactive, 2015-08-04); we used to spawn the pager via the shell, accepting things like PAGER='less -S' in the environment, but the rewrite forgot and tried to directly spawn a command whose name is the entire string. The previous refactoring of the new helper function makes it easier for us to do the right thing. Signed-off-by: Junio C Hamano <gitster@pobox.com> 17 February 2016, 17:52:20 UTC
3e3a4a4 Junio C Hamano 16 February 2016, 22:34:44 UTC pager: factor out a helper to prepare a child process to run the pager When running a pager, we need to run the program git_pager() gave us, but we need to make sure we spawn it via the shell (i.e. it is valid to say PAGER='less -S', for example) and give default values to $LESS and $LV environment variables. Factor out these details to a separate helper function. Signed-off-by: Junio C Hamano <gitster@pobox.com> 17 February 2016, 17:19:15 UTC
43b0190 Junio C Hamano 16 February 2016, 22:26:40 UTC pager: lose a separate argv[] These days, using the embedded args array in the child_process structure is the norm. Follow that practice. Signed-off-by: Junio C Hamano <gitster@pobox.com> 16 February 2016, 22:26:40 UTC
b4c8aba Patrick Steinhardt 16 February 2016, 12:56:28 UTC config: introduce set_or_die wrappers A lot of call-sites for the existing family of `git_config_set` functions do not check for errors that may occur, e.g. when the configuration file is locked. In many cases we simply want to die when such a situation arises. Introduce wrappers that will cause the program to die in those cases. These wrappers are temporary only to ease the transition to let `git_config_set` die by default. They will be removed later on when `git_config_set` itself has been replaced by `git_config_set_gently`. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com> 16 February 2016, 22:14:14 UTC
0054045 Shawn Pearce 14 February 2016, 01:39:34 UTC remote-curl: include curl_errorstr on SSL setup failures For curl error 35 (CURLE_SSL_CONNECT_ERROR) users need the additional text stored in CURLOPT_ERRORBUFFER to debug why the connection did not start. This is curl_errorstr inside of http.c, so include that in the message if it is non-empty. Sometimes HTTP response codes aren't yet available, such as when the SSL setup fails. Don't include HTTP 0 in the message. Signed-off-by: Shawn Pearce <spearce@spearce.org> Signed-off-by: Junio C Hamano <gitster@pobox.com> 15 February 2016, 21:21:43 UTC
17f1365 Nguyễn Thái Ngọc Duy 12 February 2016, 04:31:45 UTC rev-parse: take prefix into account in --git-common-dir Most of the time, get_git_common_dir() returns an absolute path so prefix is irrelevant. If it returns a relative path (e.g. from the main worktree) then prefixing is required. Noticed-by: Mike Hommey <mh@glandium.org> Signed-off-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 February 2016, 00:01:47 UTC
back to top