summaryrefslogtreecommitdiff
path: root/src/signature.c
Commit message (Collapse)AuthorAgeFilesLines
* git_error: use new names in internal APIs and usageEdward Thomson2019-01-221-11/+11
| | | | | Move to the `git_error` name in the internal API for error-related functions.
* signature: fix out-of-bounds read when parsing timezone offsetPatrick Steinhardt2018-11-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | When parsing a signature's timezone offset, we first check whether there is a timezone at all by verifying that there are still bytes left to read following the time itself. The check thus looks like `time_end + 1 < buffer_end`, which is actually correct in this case. After setting the timezone's start pointer to that location, we compute the remaining bytes by using the formula `buffer_end - tz_start + 1`, re-using the previous `time_end + 1`. But this is in fact missing the braces around `(tz_start + 1)`, thus leading to an overestimation of the remaining bytes by a length of two. In case of a non-NUL terminated buffer, this will result in an overflow. The function `git_signature__parse` is only used in two locations. First is `git_signature_from_buffer`, which only accepts a string without a length. The string thus necessarily has to be NUL terminated and cannot trigger the issue. The other function is `git_commit__parse_raw`, which can in fact trigger the error as it may receive non-NUL terminated commit data. But as objects read from the ODB are always NUL-terminated by us as a cautionary measure, it cannot trigger the issue either. In other words, this error does not have any impact on security.
* signature: avoid out-of-bounds reads when parsing signature datesPatrick Steinhardt2018-10-181-2/+4
| | | | | | | | | | We use `git__strtol64` and `git__strtol32` to parse the trailing commit or author date and timezone of signatures. As signatures are usually part of a commit or tag object and thus essentially untrusted data, the buffer may be misformatted and may not be `NUL` terminated. This may lead to an out-of-bounds read. Fix the issue by using `git__strntol64` and `git__strntol32` instead.
* treewide: remove use of C++ style commentsPatrick Steinhardt2018-07-131-1/+1
| | | | | | | | | C++ style comment ("//") are not specified by the ISO C90 standard and thus do not conform to it. While libgit2 aims to conform to C90, we did not enforce it until now, which is why quite a lot of these non-conforming comments have snuck into our codebase. Do a tree-wide conversion of all C++ style comments to the supported C style comments to allow us enforcing strict C90 compliance in a later commit.
* signature: distinguish +0000 and -0000 UTC offsetsHenry Kleynhans2017-11-121-2/+7
| | | | | | | | | | | | | | Git considers '-0000' a valid offset for signature lines. They need to be treated as _not_ equal to a '+0000' signature offset. Parsing a signature line stores the offset in a signed integer which does not distinguish between `+0` and `-0`. This patch adds an additional flag `sign` to the `git_time` in the `signature` object which is populated with the sign of the offset. In addition to exposing this information to the user, this information is also used to compare signatures. /cc @pks-t @ethomson
* Merge pull request #4288 from pks-t/pks/include-fixupsEdward Thomson2017-08-151-1/+1
|\ | | | | Include fixups
| * Make sure to always include "common.h" firstPatrick Steinhardt2017-07-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Next to including several files, our "common.h" header also declares various macros which are then used throughout the project. As such, we have to make sure to always include this file first in all implementation files. Otherwise, we might encounter problems or even silent behavioural differences due to macros or defines not being defined as they should be. So in fact, our header and implementation files should make sure to always include "common.h" first. This commit does so by establishing a common include pattern. Header files inside of "src" will now always include "common.h" as its first other file, separated by a newline from all the other includes to make it stand out as special. There are two cases for the implementation files. If they do have a matching header file, they will always include this one first, leading to "common.h" being transitively included as first file. If they do not have a matching header file, they instead include "common.h" as first file themselves. This fixes the outlined problems and will become our standard practice for header and source files inside of the "src/" from now on.
* | signature: don't leave a dangling pointer to the strings on parse failurecmn/tag-bad-signatureCarlos Martín Nieto2017-07-121-0/+1
|/ | | | | | | | If the signature is invalid but we detect that after allocating the strings, we free them. We however leave that pointer dangling in the structure the caller gave us, which can lead to double-free. Set these pointers to `NULL` after freeing their memory to avoid this.
* signature: free dup'd buffers on parse errorEdward Thomson2017-05-011-1/+4
|
* giterr_set: consistent error messagesEdward Thomson2016-12-291-1/+1
| | | | | | | | Error messages should be sentence fragments, and therefore: 1. Should not begin with a capital letter, 2. Should not conclude with punctuation, and 3. Should not end a sentence and begin a new one
* Fix off-by-one problems in git_signature__parseAndreas Henriksson2016-12-171-1/+1
| | | | | | | | | | Etc/GMT-14 aka UTC+14:00 is a thing.... https://en.wikipedia.org/wiki/UTC%2B14:00 Also allow offsets on the last minute (59). Addresses: https://bugs.debian.org/841532 Fixes: #3970
* Introduce `git_signature_from_buffer`ethomson/signature_from_bufferEdward Thomson2016-04-281-1/+26
| | | | | Allow users to construct a signature from the type of signature lines that actually appear in commits.
* signature: use GITERR_CHECK_ALLOC to check for OOM situationPatrick Steinhardt2016-02-181-3/+2
| | | | | | | When checking for out of memory situations we usually use the GITERR_CHECK_ALLOC macro. Besides conforming to our current code base it adds the benefit of silencing errors in Coverity due to Coverity handling the macro's error path as abort.
* signature: Strip crud just like Git doesVicent Marti2015-10-211-2/+16
|
* Introduce git_rebase_commitEdward Thomson2014-10-261-0/+11
| | | | Commit the current patch of a rebase process.
* signature: add a dup function which takes a poolCarlos Martín Nieto2014-09-301-0/+24
| | | | This will be used by the transaction code.
* signature: don't allow empty emailscmn/signature-empty-emailCarlos Martín Nieto2014-09-101-2/+2
| | | | | | A signature is made up of a non-empty name and a non-empty email so let's validate that. This also brings us more in line with git, which also rejects ident with an empty email.
* repository: introduce a convenience config snapshot methodcmn/config-snapshotCarlos Martín Nieto2014-05-071-5/+2
| | | | | | Accessing the repository's config and immediately taking a snapshot of it is a common operation, so let's provide a convenience function for it.
* Use config snapshottingCarlos Martín Nieto2014-04-181-2/+5
| | | | | This way we can assume we have a consistent view of the config situation when we're looking up remote, branch, pack-objects, etc.
* Add git_commit_amend APIRussell Belfer2014-02-071-0/+2
| | | | | | | | | This adds an API to amend an existing commit, basically a shorthand for creating a new commit filling in missing parameters from the values of an existing commit. As part of this, I also added a new "sys" API to create a commit using a callback to get the parents. This allowed me to rewrite all the other commit creation APIs so that temporary allocations are no longer needed.
* Align git_signature_dup.Arthur Schreiber2014-01-141-12/+17
| | | | | | This changes git_signature_dup to actually honor oom conditions raised by the call to git__strdup. It also aligns it with the error code return pattern used everywhere else.
* Don't leak memory when duplicating a NULL signatureBen Straub2013-11-121-1/+5
|
* Add new git_signature_default API using configRussell Belfer2013-08-161-1/+18
| | | | | This adds a new API for creating a signature that uses the config to look up "user.name" and "user.email".
* Merge pull request #1642 from arrbee/diff-function-contextVicent Martí2013-06-121-0/+1
|\ | | | | Diff code reorg plus function context in diff headers
| * Reorganize diff and add basic diff driverRussell Belfer2013-06-101-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a significant reorganization of the diff code to break it into a set of more clearly distinct files and to document the new organization. Hopefully this will make the diff code easier to understand and to extend. This adds a new `git_diff_driver` object that looks of diff driver information from the attributes and the config so that things like function content in diff headers can be provided. The full driver spec is not implemented in the commit - this is focused on the reorganization of the code and putting the driver hooks in place. This also removes a few #includes from src/repository.h that were overbroad, but as a result required extra #includes in a variety of places since including src/repository.h no longer results in pulling in the whole world.
* | signature: extend trimming to more whitespaceCarlos Martín Nieto2013-06-111-2/+2
|/ | | | | | There are all sorts of misconfiguration in the wild. We already rely on the signature constructor to trim SP. Extend the logic to use `isspace` to decide whether a character should be trimmed.
* Don't bail on parsing commits with an invalid timezoneScott J. Goldman2013-06-021-2/+4
| | | | | | git doesn't do that, and it's not something that's usually actionable to fix. if you have a git repository with one bad timezone in the history, it's too late to change it most likely.
* Fix trailing whitespacesnulltoken2013-05-151-1/+1
|
* signature: Lenient when dupping, strict when creatingVicent Marti2013-05-151-5/+14
|
* Return error for empty name/emailNicolas Viennot2013-04-181-1/+1
|
* signature: Small cleanupsignatures-2Vicent Marti2013-02-201-3/+2
|
* signature: Shut up MSVC, you silly gooseVicent Marti2013-02-201-6/+3
|
* Simplify signature parsingVicent Marti2013-02-201-191/+63
|
* Parse commit time as uint64_t to avoid overflowRussell Belfer2013-01-211-2/+2
| | | | | | | The commit time is already stored as a git_time_t, but we were parsing is as a uint32_t. This just switches the parser to use uint64_t which will handle dates further in the future (and adds some tests of those future dates).
* update copyrightsEdward Thomson2013-01-081-1/+1
|
* Remove GIT_SIGNATURE_VERSION and friendsBen Straub2012-12-031-3/+1
|
* Deploy GIT_SIGNATURE_INITBen Straub2012-11-301-1/+3
|
* Fix MSVC compilation warningsnulltoken2012-09-041-1/+1
|
* signature: make the OS give us the offset for git_signature_nowCarlos Martín Nieto2012-08-281-10/+12
| | | | | | There is a better and less fragile way to calculate time offsets. Let the OS take care of dealing with DST and simply take the the offset between the local time and UTC that it gives us.
* signature: prevent angle bracket usage in identitynulltoken2012-07-111-5/+19
|
* Rename posix wrappers with 'p_' prefix.Ben Straub2012-06-061-2/+2
|
* Merge branch 'development' into rev-parseBen Straub2012-06-051-2/+2
|\ | | | | | | | | | | Conflicts: src/util.h tests-clar/refs/branches/listall.c
| * errors: Rename the generic return codesVicent Martí2012-05-181-2/+2
| |
* | Fix date.c build in msvc.Ben Straub2012-05-151-12/+0
|/ | | | | | Ported the win32 implementations of gmtime_r, localtime_r, and gettimeofday to be part of the posix compatibility layer, and fixed git_signature_now to use them.
* Fix warnings on 64-bit windows buildsRussell Belfer2012-04-171-1/+1
| | | | | This fixes all the warnings on win64 except those in deps, which come from the regex code.
* Convert reflog to new errorsRussell Belfer2012-03-201-1/+1
| | | | Cleaned up some other issues.
* Convert indexer, notes, sha1_lookup, and signatureRussell Belfer2012-03-191-61/+60
| | | | More files moved to new error handling style.
* Update Copyright headerschu2012-02-131-1/+1
| | | | Signed-off-by: schu <schu-github@schulog.org>
* Use git_buf for path storage instead of stack-based buffersRussell Belfer2011-12-071-0/+2
| | | | | | | | | | | | | | | | | | | | This converts virtually all of the places that allocate GIT_PATH_MAX buffers on the stack for manipulating paths to use git_buf objects instead. The patch is pretty careful not to touch the public API for libgit2, so there are a few places that still use GIT_PATH_MAX. This extends and changes some details of the git_buf implementation to add a couple of extra functions and to make error handling easier. This includes serious alterations to all the path.c functions, and several of the fileops.c ones, too. Also, there are a number of new functions that parallel existing ones except that use a git_buf instead of a stack-based buffer (such as git_config_find_global_r that exists alongsize git_config_find_global). This also modifies the win32 version of p_realpath to allocate whatever buffer size is needed to accommodate the realpath instead of hardcoding a GIT_PATH_MAX limit, but that change needs to be tested still.
* global: Properly use `git__` memory wrappersVicent Marti2011-10-281-3/+3
| | | | | Ensure that all memory related functions (malloc, calloc, strdup, free, etc) are using their respective `git__` wrappers.
View Lorry Controller Status