| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
| |
PCRE2's header defines just the basic names but that means that we'll link
against libc's version while using PCRE2's struct definitions, leading to
crashes. To work around this, package maintainers have added prefixes to the
exported functions so we can link against them.
But the definitions in the header are still of the basic names so we need to
tell the compiler/linker to replace these names when linking.
|
| |\
| |
| | |
apply: git_apply_to_tree fails to apply patches that add new files
|
| | | |
|
| | |
| |
| |
| |
| | |
Introduce an unit test to validate if git_apply_to_tree() fails when an
applied patch adds new files.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
git_apply_to_tree() cannot be used apply patches with new files. An attempt
to apply such a patch fails because git_apply_to_tree() tries to remove a
non-existing file from an old index.
The solution is to modify git_apply_to_tree() to git_index_remove() when the
patch states that the modified files is removed.
|
| |\ \
| | |
| | | |
Optionally read `.gitattributes` from HEAD
|
| | | |
| | |
| | |
| | |
| | | |
Ensure that a `.gitattributes` file that is deeper in the tree is
honored, not just an attributes file at the root.
|
| | | |
| | |
| | |
| | |
| | | |
Add a subdirectory in the crlf.git bare repository that has a
second-level .gitattribute file.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | | |
When `GIT_BLOB_FILTER_ATTTRIBUTES_FROM_HEAD` is passed to
`git_blob_filter`, read attributes from `gitattributes` files that
are checked in to the repository at the HEAD revision. This passes
the flag `GIT_FILTER_ATTRIBUTES_FROM_HEAD` to the filter functions.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | | |
When `GIT_FILTER_ATTRIBUTES_FROM_HEAD` is specified, configure the
filter to read filter attributes from `gitattributes` files that are
checked in to the repository at the HEAD revision. This passes the flag
`GIT_ATTR_CHECK_INCLUDE_HEAD` to the attribute reading functions.
|
| | | |
| | |
| | |
| | |
| | | |
When `GIT_ATTR_CHECK_INCLUDE_HEAD` is specified, read `gitattribute`
files that are checked into the repository at the HEAD revision.
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Introduce `GIT_BLOB_FILTER_NO_SYSTEM_ATTRIBUTES`, which tells
`git_blob_filter` to ignore the system-wide attributes file, usually
`/etc/gitattributes`.
This simply passes the appropriate flag to the attribute loading code.
|
| | | |
| | |
| | |
| | |
| | |
| | | |
Allow system-wide attributes (the ones specified in
`/etc/gitattributes`) to be ignored if the flag
`GIT_FILTER_NO_SYSTEM_ATTRIBUTES` is specified.
|
| | | |
| | |
| | |
| | |
| | | |
Test that we can optionally ignore system attributes when filtering a
blob.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | | |
By default, `/etc/gitattributes` (or the system equivalent) is read to
provide attributes. Ensure that, by default, this is read when
filtering blobs.
|
| | | |
| | |
| | |
| | | |
Users should now use `git_blob_filter`.
|
| | | |
| | |
| | |
| | | |
Move users of `git_blob_filtered_content` to `git_blob_filter`.
|
| | | |
| | |
| | |
| | |
| | | |
Provide a function to filter blobs that allows for more functionality
than the existing `git_blob_filtered_content` function.
|
| | | |
| | |
| | |
| | | |
Add a LF->CRLF conversion test to the blob filter.
|
| |\ \ \
| | | |
| | | | |
config: implement "onbranch" conditional
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
With Git v2.23.0, the conditional include mechanism gained another new
conditional "onbranch". As the name says, it will cause a file to be
included if the "onbranch" pattern matches the currently checked out
branch.
Implement this new condition and add a bunch of tests.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
When assembling contents of the conditionally including file, we use
`git_buf_printf` and `git_buf_puts` without checking for error returns.
Add `cl_git_pass` to fix this.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Add a few tests that verify some behaviour centered around includes. The
first set of tests verifies that we correctly override values depending
on the order of includes and other keys, the second set asserts that we
can correctly snapshot configuration files with includes.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Modernize the tests in config::snapshot to make them easier to
understand. Most important, include a cleanup function that frees config
and snapshot and unlink config files at the end of each test.
|
| |\ \ \ \
| | | | |
| | | | | |
Fix include casing for case-sensitive filesystems.
|
| | | | | | |
|
| |\ \ \ \ \
| | | | | |
| | | | | | |
util: use 64 bit timer on Windows
|
| | | | | | | |
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
git__timer was originally implemented using a 32 bit timer since
Windows XP did not support GetTickCount64. Windows XP was discontinued
five years ago, so it should be safe to use the new API.
As a benefit, we do not need to care about overflows for the next 585
million years.
|
| | | | | | | |
|
| |\ \ \ \ \ \
| |_|_|_|_|/
|/| | | | | |
Memory allocation audit
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Our hand-rolled fallback sorting function `git__insertsort_r` does an
in-place sort of the given array. As elements may not necessarily be
pointers, it needs a way of swapping two values of arbitrary size, which
is currently implemented by allocating a temporary buffer of the
element's size. This is problematic, though, as the emulated `qsort`
interface doesn't provide any return values and thus cannot signal an
error if allocation of that temporary buffer has failed.
Convert the function to swap via a temporary buffer allocated on the
stack. Like this, it can `memcpy` contents of both elements in small
batches without requiring a heap allocation. The buffer size has been
chosen such that in most cases, a single iteration of copying will
suffice. Most importantly, it can fully contain `git_oid` structures and
pointers.
Add a bunch of tests for the `git__qsort_r` interface to verify nothing
breaks. Furthermore, this removes the declaration of `git__insertsort_r`
and makes it static as it is not used anywhere else.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The xdiff code contains multiple call sites where the results of
`xdl_malloc` are not being checked for memory allocation errors.
Add checks to fix possible segfaults due to `NULL` pointer accesses.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
When allocating a chunk that is used to write to HTTP streams, we do not
check for memory allocation errors. This may lead us to write to a
`NULL` pointer and thus cause a segfault.
Fix this by adding a call to `GIT_ERROR_CHECK_ALLOC`.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The "trailer.c" code has been copied mostly verbatim from git.git with
minor adjustments, only. As git.git's `xmalloc` function, which aborts
on memory allocation errors, has been swapped out for `git_malloc`,
which doesn't abort, we may inadvertently access `NULL` pointers.
Add checks to fix this.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
In "posix.c" there are multiple callsites which execute `malloc` instead
of `git__malloc`. Thus, users of library are not able to track these
allocations with a custom allocator.
Convert these call sites to use `git__malloc` instead.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
When adding OIDs to the indexer's map of yet-to-be-seen OIDs to verify
that packfiles are complete, we do so by first allocating a new OID and
then calling `git_oidmap_set` on it. There was no check for memory
allocation errors in place, though, leading to possible segfaults due to
trying to copy data to a `NULL` pointer.
Verify the result of `git__malloc` with `GIT_ERROR_CHECK_ALLOC` to fix
the issue.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The function `git_commit_list_insert` dynamically allocates memory and
may thus fail to insert a given commit, but we didn't check for that in
several places in "merge.c".
Convert surrounding functions to return error codes and check whether
`git_commit_list_insert` was successful, returning an error if not.
|
| |/ / / / /
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
The code in "blame_git.c" was mostly imported from git.git with only
minor changes. One of these changes was to use our own allocators
instead of git's `xmalloc`, but there's a subtle difference: `xmalloc`
would abort the program if unable to allocate any memory, bit
`git__malloc` doesn't. As we didn't check for memory allocation errors
in some places, we might inadvertently dereference a `NULL` pointer in
out-of-memory situations.
Convert multiple functions to return proper error codes and add calls to
`GIT_ERROR_CHECK_ALLOC` to fix this.
|
| |\ \ \ \ \
| |_|/ / /
|/| | | | |
clone: don't decode URL percent encodings
|
| | | | | |
| | | | |
| | | | |
| | | | | |
Will add later when infrastructure is configured
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| | | | | | |
|
| |\ \ \ \ \
| | | | | |
| | | | | | |
Security updates from 0.28.3
|
| | | | | | | |
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The function `commit_quick_parse` provides a way to quickly parse
parts of a commit without storing or verifying most of its
metadata. The first thing it does is calculating the number of
parents by skipping "parent " lines until it finds the first
non-parent line. Afterwards, this parent count is passed to
`alloc_parents`, which will allocate an array to store all the
parent.
To calculate the amount of storage required for the parents
array, `alloc_parents` simply multiplicates the number of parents
with the respective elements's size. This already screams "buffer
overflow", and in fact this problem is getting worse by the
result being cast to an `uint32_t`.
In fact, triggering this is possible: git-hash-object(1) will
happily write a commit with multiple millions of parents for you.
I've stopped at 67,108,864 parents as git-hash-object(1)
unfortunately soaks up the complete object without streaming
anything to disk and thus will cause an OOM situation at a later
point. The point here is: this commit was about 4.1GB of size but
compressed down to 24MB and thus easy to distribute.
The above doesn't yet trigger the buffer overflow, thus. As the
array's elements are all pointers which are 8 bytes on 64 bit, we
need a total of 536,870,912 parents to trigger the overflow to
`0`. The effect is that we're now underallocating the array
and do an out-of-bound writes. As the buffer is kindly provided
by the adversary, this may easily result in code execution.
Extrapolating from the test file with 67m commits to the one with
536m commits results in a factor of 8. Thus the uncompressed
contents would be about 32GB in size and the compressed ones
192MB. While still easily distributable via the network, only
servers will have that amount of RAM and not cause an
out-of-memory condition previous to triggering the overflow. This
at least makes this attack not an easy vector for client-side use
of libgit2.
|
