OSDN Git Service
Jeff King [Wed, 27 Sep 2017 06:02:27 +0000 (02:02 -0400)]
worktree: check the result of read_in_full()
We try to read "len" bytes into a buffer and just assume
that it happened correctly. In practice this should usually
be the case, since we just stat'd the file to get the
length. But we could be fooled by transient errors or by
other processes racily truncating the file.
Let's be more careful. There's a slim chance this could
catch a real error, but it also prevents people and tools
from getting worried while reading the code.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 27 Sep 2017 06:02:21 +0000 (02:02 -0400)]
worktree: use xsize_t to access file size
To read the "gitdir" file into memory, we stat the file and
allocate a buffer. But we store the size in an "int", which
may be truncated. We should use a size_t and xsize_t(),
which will detect truncation.
An overflow is unlikely for a "gitdir" file, but it's a good
practice to model.
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 27 Sep 2017 06:02:11 +0000 (02:02 -0400)]
distinguish error versus short read from read_in_full()
Many callers of read_in_full() expect to see the exact
number of bytes requested, but their error handling lumps
together true read errors and short reads due to unexpected
EOF.
We can give more specific error messages by separating these
cases (showing errno when appropriate, and otherwise
describing the short read).
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 27 Sep 2017 06:01:07 +0000 (02:01 -0400)]
avoid looking at errno for short read_in_full() returns
When a caller tries to read a particular set of bytes via
read_in_full(), there are three possible outcomes:
1. An error, in which case -1 is returned and errno is
set.
2. A short read, in which fewer bytes are returned and
errno is unspecified (we never saw a read error, so we
may have some random value from whatever syscall failed
last).
3. The full read completed successfully.
Many callers handle cases 1 and 2 together by just checking
the result against the requested size. If their combined
error path looks at errno (e.g., by calling die_errno), they
may report a nonsense value.
Let's fix these sites by having them distinguish between the
two error cases. That avoids the random errno confusion, and
lets us give more detailed error messages.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 27 Sep 2017 06:00:28 +0000 (02:00 -0400)]
prefer "!=" when checking read_in_full() result
Comparing the result of read_in_full() using less-than is
potentially dangerous, as a negative return value may be
converted to an unsigned type and be considered a success.
This is discussed further in
561598cfcf (read_pack_header:
handle signed/unsigned comparison in read result,
2017-09-13).
Each of these instances is actually fine in practice:
- in get-tar-commit-id, the HEADERSIZE macro expands to a
signed integer. If it were switched to an unsigned type
(e.g., a size_t), then it would be a bug.
- the other two callers check for a short read only after
handling a negative return separately. This is a fine
practice, but we'd prefer to model "!=" as a general
rule.
So all of these cases can be considered cleanups and not
actual bugfixes.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Mon, 25 Sep 2017 20:27:57 +0000 (16:27 -0400)]
notes-merge: drop dead zero-write code
We call write_in_full() with a size that we know is greater
than zero. The return value can never be zero, then, since
write_in_full() converts such a failed write() into ENOSPC
and returns -1. We can just drop this branch of the error
handling entirely.
Suggested-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Mon, 25 Sep 2017 20:27:17 +0000 (16:27 -0400)]
files-backend: prefer "0" for write_in_full() error check
Commit
06f46f237a (avoid "write_in_full(fd, buf, len) !=
len" pattern, 2017-09-13) converted this callsite from:
write_in_full(...) != 1
to
write_in_full(...) < 0
But during the conflict resolution in
c50424a6f0 (Merge
branch 'jk/write-in-full-fix', 2017-09-25), this morphed
into
write_in_full(...) < 1
This behaves as we want, but we prefer to avoid modeling the
"less than length" error-check which can be subtly buggy, as
shown in
efacf609c8 (config: avoid "write_in_full(fd, buf,
len) < len" pattern, 2017-09-13).
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano [Mon, 25 Sep 2017 06:24:06 +0000 (15:24 +0900)]
Merge branch 'jk/write-in-full-fix'
Many codepaths did not diagnose write failures correctly when disks
go full, due to their misuse of write_in_full() helper function,
which have been corrected.
* jk/write-in-full-fix:
read_pack_header: handle signed/unsigned comparison in read result
config: flip return value of store_write_*()
notes-merge: use ssize_t for write_in_full() return value
pkt-line: check write_in_full() errors against "< 0"
convert less-trivial versions of "write_in_full() != len"
avoid "write_in_full(fd, buf, len) != len" pattern
get-tar-commit-id: check write_in_full() return against 0
config: avoid "write_in_full(fd, buf, len) < len" pattern
Junio C Hamano [Mon, 25 Sep 2017 06:24:06 +0000 (15:24 +0900)]
Merge branch 'ez/doc-duplicated-words-fix'
Typofix.
* ez/doc-duplicated-words-fix:
doc: fix minor typos (extra/duplicated words)
Junio C Hamano [Mon, 25 Sep 2017 06:24:06 +0000 (15:24 +0900)]
Merge branch 'kd/doc-for-each-ref'
Doc update.
* kd/doc-for-each-ref:
doc/for-each-ref: explicitly specify option names
doc/for-each-ref: consistently use '=' to between argument names and values
Junio C Hamano [Mon, 25 Sep 2017 06:24:06 +0000 (15:24 +0900)]
Merge branch 'cc/subprocess-handshake-missing-capabilities'
Finishing touches to a topic already in 'master'.
* cc/subprocess-handshake-missing-capabilities:
subprocess: loudly die when subprocess asks for an unsupported capability
Junio C Hamano [Mon, 25 Sep 2017 06:24:05 +0000 (15:24 +0900)]
Merge branch 'kw/write-index-reduce-alloc'
A hotfix to a topic already in 'master'.
* kw/write-index-reduce-alloc:
read-cache: fix index corruption with index v4
Add t/helper/test-write-cache to .gitignore
Junio C Hamano [Mon, 25 Sep 2017 06:24:05 +0000 (15:24 +0900)]
Merge branch 'mg/name-rev-tests-with-short-stack'
A handful of tests to demonstrates a recursive implementation of
"name-rev" hurts.
* mg/name-rev-tests-with-short-stack:
t6120: test describe and name-rev with deep repos
t6120: clean up state after breaking repo
t6120: test name-rev --all and --stdin
t7004: move limited stack prereq to test-lib
Junio C Hamano [Thu, 21 Sep 2017 04:38:37 +0000 (13:38 +0900)]
Merge branch 'jk/leak-checkers'
Many of our programs consider that it is OK to release dynamic
storage that is used throughout the life of the program by simply
exiting, but this makes it harder to leak detection tools to avoid
reporting false positives. Plug many existing leaks and introduce
a mechanism for developers to mark that the region of memory
pointed by a pointer is not lost/leaking to help these tools.
* jk/leak-checkers:
git-compat-util: make UNLEAK less error-prone
Jonathan Tan [Tue, 19 Sep 2017 22:10:04 +0000 (15:10 -0700)]
git-compat-util: make UNLEAK less error-prone
Commit
0e5bba5 ("add UNLEAK annotation for reducing leak false
positives", 2017-09-08) introduced an UNLEAK macro to be used as
"UNLEAK(var);", but its existing definitions leave semicolons that act
as empty statements, which will lead to syntax errors, e.g.
if (condition)
UNLEAK(var);
else
something_else(var);
would be broken with two statements between if (condition) and else.
Lose the excess semicolon from the end of the macro replacement text.
Signed-off-by: Jonathan Tan <jonathantanmy@google.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano [Tue, 19 Sep 2017 01:55:19 +0000 (10:55 +0900)]
The eighth batch for 2.15
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano [Tue, 19 Sep 2017 01:47:57 +0000 (10:47 +0900)]
Merge branch 'rk/commit-tree-make-F-verbatim'
Unlike "git commit-tree < file", "git commit-tree -F file" did not
pass the contents of the file verbatim and instead completed an
incomplete line at the end, if exists. The latter has been updated
to match the behaviour of the former.
* rk/commit-tree-make-F-verbatim:
commit-tree: do not complete line in -F input
Junio C Hamano [Tue, 19 Sep 2017 01:47:57 +0000 (10:47 +0900)]
Merge branch 'rs/strbuf-leakfix'
Many leaks of strbuf have been fixed.
* rs/strbuf-leakfix: (34 commits)
wt-status: release strbuf after use in wt_longstatus_print_tracking()
wt-status: release strbuf after use in read_rebase_todolist()
vcs-svn: release strbuf after use in end_revision()
utf8: release strbuf on error return in strbuf_utf8_replace()
userdiff: release strbuf after use in userdiff_get_textconv()
transport-helper: release strbuf after use in process_connect_service()
sequencer: release strbuf after use in save_head()
shortlog: release strbuf after use in insert_one_record()
sha1_file: release strbuf on error return in index_path()
send-pack: release strbuf on error return in send_pack()
remote: release strbuf after use in set_url()
remote: release strbuf after use in migrate_file()
remote: release strbuf after use in read_remote_branches()
refs: release strbuf on error return in write_pseudoref()
notes: release strbuf after use in notes_copy_from_stdin()
merge: release strbuf after use in write_merge_heads()
merge: release strbuf after use in save_state()
mailinfo: release strbuf on error return in handle_boundary()
mailinfo: release strbuf after use in handle_from()
help: release strbuf on error return in exec_woman_emacs()
...
Junio C Hamano [Tue, 19 Sep 2017 01:47:56 +0000 (10:47 +0900)]
Merge branch 'jk/shortlog-ident-cleanup'
Code clean-up.
* jk/shortlog-ident-cleanup:
shortlog: skip format/parse roundtrip for internal traversal
Junio C Hamano [Tue, 19 Sep 2017 01:47:56 +0000 (10:47 +0900)]
Merge branch 'mh/packed-ref-transactions'
Implement transactional update to the packed-ref representation of
references.
* mh/packed-ref-transactions:
files_transaction_finish(): delete reflogs before references
packed-backend: rip out some now-unused code
files_ref_store: use a transaction to update packed refs
t1404: demonstrate two problems with reference transactions
files_initial_transaction_commit(): use a transaction for packed refs
prune_refs(): also free the linked list
files_pack_refs(): use a reference transaction to write packed refs
packed_delete_refs(): implement method
packed_ref_store: implement reference transactions
struct ref_transaction: add a place for backends to store data
packed-backend: don't adjust the reference count on lock/unlock
Junio C Hamano [Tue, 19 Sep 2017 01:47:56 +0000 (10:47 +0900)]
Merge branch 'kw/merge-recursive-cleanup'
A leakfix and code clean-up.
* kw/merge-recursive-cleanup:
merge-recursive: change current file dir string_lists to hashmap
merge-recursive: remove return value from get_files_dirs
merge-recursive: fix memory leak
Junio C Hamano [Tue, 19 Sep 2017 01:47:56 +0000 (10:47 +0900)]
Merge branch 'sb/merge-commit-msg-hook'
As "git commit" to conclude a conflicted "git merge" honors the
commit-msg hook, "git merge" that recoreds a merge commit that
cleanly auto-merges should, but it didn't.
* sb/merge-commit-msg-hook:
builtin/merge: honor commit-msg hook for merges
Junio C Hamano [Tue, 19 Sep 2017 01:47:55 +0000 (10:47 +0900)]
Merge branch 'jk/leak-checkers'
Many of our programs consider that it is OK to release dynamic
storage that is used throughout the life of the program by simply
exiting, but this makes it harder to leak detection tools to avoid
reporting false positives. Plug many existing leaks and introduce
a mechanism for developers to mark that the region of memory
pointed by a pointer is not lost/leaking to help these tools.
* jk/leak-checkers:
add UNLEAK annotation for reducing leak false positives
set_git_dir: handle feeding gitdir to itself
repository: free fields before overwriting them
reset: free allocated tree buffers
reset: make tree counting less confusing
config: plug user_config leak
update-index: fix cache entry leak in add_one_file()
add: free leaked pathspec after add_files_to_cache()
test-lib: set LSAN_OPTIONS to abort by default
test-lib: --valgrind should not override --verbose-log
Junio C Hamano [Tue, 19 Sep 2017 01:47:55 +0000 (10:47 +0900)]
Merge branch 'nm/pull-submodule-recurse-config'
"git -c submodule.recurse=yes pull" did not work as if the
"--recurse-submodules" option was given from the command line.
This has been corrected.
* nm/pull-submodule-recurse-config:
pull: honor submodule.recurse config option
pull: fix cli and config option parsing order
Junio C Hamano [Tue, 19 Sep 2017 01:47:55 +0000 (10:47 +0900)]
Merge branch 'mh/packed-ref-store-prep'
Fix regression to "gitk --bisect" by a recent update.
* mh/packed-ref-store-prep:
rev-parse: don't trim bisect refnames
Junio C Hamano [Tue, 19 Sep 2017 01:47:55 +0000 (10:47 +0900)]
Merge branch 'ma/remove-config-maybe-bool'
Finishing touches to a recent topic.
* ma/remove-config-maybe-bool:
config: remove git_config_maybe_bool
Junio C Hamano [Tue, 19 Sep 2017 01:47:55 +0000 (10:47 +0900)]
Merge branch 'jk/system-path-cleanup'
Code clean-up.
* jk/system-path-cleanup:
git_extract_argv0_path: do nothing without RUNTIME_PREFIX
system_path: move RUNTIME_PREFIX to a sub-function
Junio C Hamano [Tue, 19 Sep 2017 01:47:54 +0000 (10:47 +0900)]
Merge branch 'jh/hashmap-disable-counting'
Our hashmap implementation in hashmap.[ch] is not thread-safe when
adding a new item needs to expand the hashtable by rehashing; add
an API to disable the automatic rehashing to work it around.
* jh/hashmap-disable-counting:
hashmap: add API to disable item counting when threaded
Junio C Hamano [Tue, 19 Sep 2017 01:47:54 +0000 (10:47 +0900)]
Merge branch 'bb/doc-eol-dirty'
Doc update.
* bb/doc-eol-dirty:
Documentation: mention that `eol` can change the dirty status of paths
Junio C Hamano [Tue, 19 Sep 2017 01:47:53 +0000 (10:47 +0900)]
Merge branch 'jt/packmigrate'
Remove unneeded file added by a topic already in 'master'.
* jt/packmigrate:
Remove inadvertently added outgoing/packfile.h
Junio C Hamano [Tue, 19 Sep 2017 01:47:53 +0000 (10:47 +0900)]
Merge branch 'jk/incore-lockfile-removal'
The long-standing rule that an in-core lockfile instance, once it
is used, must not be freed, has been lifted and the lockfile and
tempfile APIs have been updated to reduce the chance of programming
errors.
* jk/incore-lockfile-removal:
stop leaking lock structs in some simple cases
ref_lock: stop leaking lock_files
lockfile: update lifetime requirements in documentation
tempfile: auto-allocate tempfiles on heap
tempfile: remove deactivated list entries
tempfile: use list.h for linked list
tempfile: release deactivated strbufs instead of resetting
tempfile: robustify cleanup handler
tempfile: factor out deactivation
tempfile: factor out activation
tempfile: replace die("BUG") with BUG()
tempfile: handle NULL tempfile pointers gracefully
tempfile: prefer is_tempfile_active to bare access
lockfile: do not rollback lock on failed close
tempfile: do not delete tempfile on failed close
always check return value of close_tempfile
verify_signed_buffer: prefer close_tempfile() to close()
setup_temporary_shallow: move tempfile struct into function
setup_temporary_shallow: avoid using inactive tempfile
write_index_as_tree: cleanup tempfile on error
Junio C Hamano [Tue, 19 Sep 2017 01:47:53 +0000 (10:47 +0900)]
Merge branch 'nd/prune-in-worktree'
"git gc" and friends when multiple worktrees are used off of a
single repository did not consider the index and per-worktree refs
of other worktrees as the root for reachability traversal, making
objects that are in use only in other worktrees to be subject to
garbage collection.
* nd/prune-in-worktree:
refs.c: reindent get_submodule_ref_store()
refs.c: remove fallback-to-main-store code get_submodule_ref_store()
rev-list: expose and document --single-worktree
revision.c: --reflog add HEAD reflog from all worktrees
files-backend: make reflog iterator go through per-worktree reflog
revision.c: --all adds HEAD from all worktrees
refs: remove dead for_each_*_submodule()
refs.c: move for_each_remote_ref_submodule() to submodule.c
revision.c: use refs_for_each*() instead of for_each_*_submodule()
refs: add refs_head_ref()
refs: move submodule slash stripping code to get_submodule_ref_store
refs.c: refactor get_submodule_ref_store(), share common free block
revision.c: --indexed-objects add objects from all worktrees
revision.c: refactor add_index_objects_to_pending()
refs.c: use is_dir_sep() in resolve_gitlink_ref()
revision.h: new flag in struct rev_info wrt. worktree-related refs
Junio C Hamano [Tue, 19 Sep 2017 01:47:53 +0000 (10:47 +0900)]
Merge branch 'ma/split-symref-update-fix'
A leakfix.
* ma/split-symref-update-fix:
refs/files-backend: add `refname`, not "HEAD", to list
refs/files-backend: correct return value in lock_ref_for_update
refs/files-backend: fix memory leak in lock_ref_for_update
refs/files-backend: add longer-scoped copy of string to list
Junio C Hamano [Tue, 19 Sep 2017 01:47:52 +0000 (10:47 +0900)]
Merge branch 'mh/notes-cleanup'
Code clean-up.
* mh/notes-cleanup:
load_subtree(): check that `prefix_len` is in the expected range
load_subtree(): declare some variables to be `size_t`
hex_to_bytes(): simpler replacement for `get_oid_hex_segment()`
get_oid_hex_segment(): don't pad the rest of `oid`
load_subtree(): combine some common code
get_oid_hex_segment(): return 0 on success
load_subtree(): only consider blobs to be potential notes
load_subtree(): check earlier whether an internal node is a tree entry
load_subtree(): separate logic for internal vs. terminal entries
load_subtree(): fix incorrect comment
load_subtree(): reduce the scope of some local variables
load_subtree(): remove unnecessary conditional
notes: make GET_NIBBLE macro more robust
Junio C Hamano [Tue, 19 Sep 2017 01:47:52 +0000 (10:47 +0900)]
Merge branch 'mg/timestamp-t-fix'
A mismerge fix.
* mg/timestamp-t-fix:
name-rev: change ULONG_MAX to TIME_MAX
Junio C Hamano [Tue, 19 Sep 2017 01:47:52 +0000 (10:47 +0900)]
Merge branch 'ma/pkt-line-leakfix'
A leakfix.
* ma/pkt-line-leakfix:
pkt-line: re-'static'-ify buffer in packet_write_fmt_1()
Junio C Hamano [Tue, 19 Sep 2017 01:47:51 +0000 (10:47 +0900)]
Merge branch 'jk/config-lockfile-leak-fix'
A leakfix.
* jk/config-lockfile-leak-fix:
config: use a static lock_file struct
Junio C Hamano [Tue, 19 Sep 2017 01:47:50 +0000 (10:47 +0900)]
Merge branch 'dw/diff-highlight-makefile-fix'
Build clean-up.
* dw/diff-highlight-makefile-fix:
diff-highlight: add clean target to Makefile
Junio C Hamano [Tue, 19 Sep 2017 01:47:50 +0000 (10:47 +0900)]
Merge branch 'ti/external-sha1dc'
Platforms that ship with a separate sha1 with collision detection
library can link to it instead of using the copy we ship as part of
our source tree.
* ti/external-sha1dc:
sha1dc: allow building with the external sha1dc library
sha1dc: build git plumbing code more explicitly
Jeff King [Wed, 13 Sep 2017 18:47:22 +0000 (14:47 -0400)]
read_pack_header: handle signed/unsigned comparison in read result
The result of read_in_full() may be -1 if we saw an error.
But in comparing it to a sizeof() result, that "-1" will be
promoted to size_t. In fact, the largest possible size_t
which is much bigger than our struct size. This means that
our "< sizeof(header)" error check won't trigger.
In practice, we'd go on to read uninitialized memory and
compare it to the PACK signature, which is likely to fail.
But we shouldn't get there.
We can fix this by making a direct "!=" comparison to the
requested size, rather than "<". This means that errors get
lumped in with short reads, but that's sufficient for our
purposes here. There's no PH_ERROR tp represent our case.
And anyway, this function reads from pipes and network
sockets. A network error may racily appear as EOF to us
anyway if there's data left in the socket buffers.
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 13 Sep 2017 17:17:57 +0000 (13:17 -0400)]
config: flip return value of store_write_*()
The store_write_section() and store_write_pairs() functions
are basically high-level wrappers around write(). But their
return values are flipped from our usual convention, using
"1" for success and "0" for failure.
Let's flip them to follow the usual write() conventions and
update all callers. As these are local to config.c, it's
unlikely that we'd have new callers in any topics in flight
(which would be silently broken by our change). But just to
be on the safe side, let's rename them to just
write_section() and write_pairs(). That also accentuates
their relationship with write().
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 13 Sep 2017 17:17:44 +0000 (13:17 -0400)]
notes-merge: use ssize_t for write_in_full() return value
We store the return value of write_in_full() in a long,
though the return is actually an ssize_t. This probably
doesn't matter much in practice (since the buffer size is
alredy an unsigned long), but it might if the size if
between what can be represented in "long" and "unsigned
long", and if your size_t is larger than a "long" (as it is
on 64-bit Windows).
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 13 Sep 2017 17:17:30 +0000 (13:17 -0400)]
pkt-line: check write_in_full() errors against "< 0"
As with the previous two commits, we prefer to check
write_in_full()'s return value to see if it is negative,
rather than comparing it to the input length.
These cases actually flip the logic to check for success,
making conversion a little different than in other cases. We
could of course write:
if (write_in_full(...) >= 0)
return 0;
return error(...);
But our usual method of spelling write() error checks is
just "< 0". So let's flip the logic for each of these
conditionals to our usual style.
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 13 Sep 2017 17:16:28 +0000 (13:16 -0400)]
convert less-trivial versions of "write_in_full() != len"
The prior commit converted many sites to check the return
value of write_in_full() for negativity, rather than a
mismatch with the input length. This patch covers similar
cases, but where the return value is stored in an
intermediate variable. These should get the same treatment,
but they need to be reviewed more carefully since it would
be a bug if the return value is stored in an unsigned type
(which indeed, it is in one of the cases).
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 13 Sep 2017 17:16:03 +0000 (13:16 -0400)]
avoid "write_in_full(fd, buf, len) != len" pattern
The return value of write_in_full() is either "-1", or the
requested number of bytes[1]. If we make a partial write
before seeing an error, we still return -1, not a partial
value. This goes back to
f6aa66cb95 (write_in_full: really
write in full or return error on disk full., 2007-01-11).
So checking anything except "was the return value negative"
is pointless. And there are a couple of reasons not to do
so:
1. It can do a funny signed/unsigned comparison. If your
"len" is signed (e.g., a size_t) then the compiler will
promote the "-1" to its unsigned variant.
This works out for "!= len" (unless you really were
trying to write the maximum size_t bytes), but is a
bug if you check "< len" (an example of which was fixed
recently in config.c).
We should avoid promoting the mental model that you
need to check the length at all, so that new sites are
not tempted to copy us.
2. Checking for a negative value is shorter to type,
especially when the length is an expression.
3. Linus says so. In
d34cf19b89 (Clean up write_in_full()
users, 2007-01-11), right after the write_in_full()
semantics were changed, he wrote:
I really wish every "write_in_full()" user would just
check against "<0" now, but this fixes the nasty and
stupid ones.
Appeals to authority aside, this makes it clear that
writing it this way does not have an intentional
benefit. It's a historical curiosity that we never
bothered to clean up (and which was undoubtedly
cargo-culted into new sites).
So let's convert these obviously-correct cases (this
includes write_str_in_full(), which is just a wrapper for
write_in_full()).
[1] A careful reader may notice there is one way that
write_in_full() can return a different value. If we ask
write() to write N bytes and get a return value that is
_larger_ than N, we could return a larger total. But
besides the fact that this would imply a totally broken
version of write(), it would already invoke undefined
behavior. Our internal remaining counter is an unsigned
size_t, which means that subtracting too many byte will
wrap it around to a very large number. So we'll instantly
begin reading off the end of the buffer, trying to write
gigabytes (or petabytes) of data.
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 13 Sep 2017 17:11:28 +0000 (13:11 -0400)]
get-tar-commit-id: check write_in_full() return against 0
We ask to write 41 bytes and make sure that the return value
is at least 41. This is the same "dangerous" pattern that
was fixed in the prior commit (wherein a negative return
value is promoted to unsigned), though it is not dangerous
here because our "41" is a constant, not an unsigned
variable.
But we should convert it anyway to avoid modeling a
dangerous construct.
Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King [Wed, 13 Sep 2017 18:15:16 +0000 (14:15 -0400)]
config: avoid "write_in_full(fd, buf, len) < len" pattern
The return type of write_in_full() is a signed ssize_t,
because we may return "-1" on failure (even if we succeeded
in writing some bytes). But "len" itself is may be an
unsigned type (the function takes a size_t, but of course we
may have something else in the calling function). So while
it seems like:
if (write_in_full(fd, buf, len) < len)
die_errno("write error");
would trigger on error, it won't if "len" is unsigned. The
compiler sees a signed/unsigned comparison and promotes the
signed value, resulting in (size_t)-1, the highest possible
size_t (or again, whatever type the caller has). This cannot
possibly be smaller than "len", and so the conditional can
never trigger.
I scoured the code base for cases of this, but it turns out
that these two in git_config_set_multivar_in_file_gently()
are the only ones. Here our "len" is the difference between
two size_t variables, making the result an unsigned size_t.
We can fix this by just checking for a negative return value
directly, as write_in_full() will never return any value
except -1 or the full count.
There's no addition to the test suite here, since you need
to convince write() to fail in order to see the problem. The
simplest reproduction recipe I came up with is to trigger
ENOSPC:
# make a limited-size filesystem
dd if=/dev/zero of=small.disk bs=1M count=1
mke2fs small.disk
mkdir mnt
sudo mount -o loop small.disk mnt
cd mnt
sudo chown $USER:$USER .
# make a config file with some content
git config --file=config one.key value
git config --file=config two.key value
# now fill up the disk
dd if=/dev/zero of=fill
# and try to delete a key, which requires copying the rest
# of the file to config.lock, and will fail on write()
git config --file=config --unset two.key
That final command should (and does after this patch)
produce an error message due to the failed write, and leave
the file intact. Instead, it silently ignores the failure
and renames config.lock into place, leaving you with a
totally empty config file!
Reported-by: demerphq <demerphq@gmail.com>
Signed-off-by: Jeff King <peff@peff.net>
Reviewed-by: Jonathan Nieder <jrnieder@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Evan Zacks [Tue, 12 Sep 2017 22:58:39 +0000 (15:58 -0700)]
doc: fix minor typos (extra/duplicated words)
Following are several fixes for duplicated words ("of of") and one
case where an extra article ("a") slipped in.
Signed-off-by: Evan Zacks <zackse@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Kevin Daudt [Mon, 11 Sep 2017 19:33:38 +0000 (21:33 +0200)]
doc/for-each-ref: explicitly specify option names
For count, sort and format, only the argument names were listed under
OPTIONS, not the option names.
Add the option names to make it clear the options exist
Signed-off-by: Kevin Daudt <me@ikke.info>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Kevin Daudt [Mon, 11 Sep 2017 19:33:37 +0000 (21:33 +0200)]
doc/for-each-ref: consistently use '=' to between argument names and values
The synopsis and description inconsistently add a '=' between the
argument name and it's value. Make this consistent.
Signed-off-by: Kevin Daudt <me@ikke.info>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano [Mon, 11 Sep 2017 03:21:29 +0000 (12:21 +0900)]
subprocess: loudly die when subprocess asks for an unsupported capability
The handshake_capabilities() function first advertises the set of
capabilities it supports, so that the other side can pick and choose
which ones to use and ask us to enable in its response. Then we
read the response that tells us what choice the other side made. If
we saw something that we never advertised, that indicates one of two
things. The other side, i.e. the "upgraded" filter, is not paying
attention of the capabilities advertisement, and asking something
its correct operation relies on, but we are not capable of giving
that unknown feature and operate without it, so after that point the
exchange of data is a garbage-in-garbage-out. Or the other side
wanted to ask for one of the capabilities we advertised, but the
code has typo and their wish to enable a capability that its correct
operation relies on is not understood on this end. The result is
the same garbage-in-garbage-out.
Instead of sweeping such a potential bug under the rug, die loudly
when we see a request for an unsupported capability in order to
force sloppily-written filter scripts to get corrected.
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano [Sun, 10 Sep 2017 08:15:43 +0000 (17:15 +0900)]
Sync with maint
* maint:
RelNotes: further fixes for 2.14.2 from the master front
Junio C Hamano [Sun, 10 Sep 2017 08:15:09 +0000 (17:15 +0900)]
The seventh batch post 2.14
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano [Sun, 10 Sep 2017 08:08:25 +0000 (17:08 +0900)]
Merge branch 'rs/apply-epoch'
Code simplification.
* rs/apply-epoch:
apply: remove epoch date from regex
apply: check date of potential epoch timestamps first
Junio C Hamano [Sun, 10 Sep 2017 08:08:25 +0000 (17:08 +0900)]
Merge branch 'jk/drop-sha1-entry-pos'
Code clean-up.
* jk/drop-sha1-entry-pos:
sha1-lookup: remove sha1_entry_pos() from header file
Junio C Hamano [Sun, 10 Sep 2017 08:08:23 +0000 (17:08 +0900)]
Merge branch 'nd/worktree-kill-parse-ref'
"git branch -M a b" while on a branch that is completely unrelated
to either branch a or branch b misbehaved when multiple worktree
was in use. This has been fixed.
* nd/worktree-kill-parse-ref:
branch: fix branch renaming not updating HEADs correctly
Junio C Hamano [Sun, 10 Sep 2017 08:08:22 +0000 (17:08 +0900)]
Merge branch 'mm/send-email-cc-cruft'
In addition to "cc: <a@dd.re.ss> # cruft", "cc: a@dd.re.ss # cruft"
was taught to "git send-email" as a valid way to tell it that it
needs to also send a carbon copy to <a@dd.re.ss> in the trailer
section.
* mm/send-email-cc-cruft:
send-email: don't use Mail::Address, even if available
send-email: fix garbage removal after address
Junio C Hamano [Sun, 10 Sep 2017 08:08:22 +0000 (17:08 +0900)]
Merge branch 'ls/convert-filter-progress'
The codepath to call external process filter for smudge/clean
operation learned to show the progress meter.
* ls/convert-filter-progress:
convert: display progress for filtered objects that have been delayed
Junio C Hamano [Sun, 10 Sep 2017 08:08:22 +0000 (17:08 +0900)]
Merge branch 'ma/up-to-date'
Message and doc updates.
* ma/up-to-date:
treewide: correct several "up-to-date" to "up to date"
Documentation/user-manual: update outdated example output
Junio C Hamano [Sun, 10 Sep 2017 08:08:22 +0000 (17:08 +0900)]
Merge branch 'ma/ts-cleanups'
Assorted bugfixes and clean-ups.
* ma/ts-cleanups:
ThreadSanitizer: add suppressions
strbuf_setlen: don't write to strbuf_slopbuf
pack-objects: take lock before accessing `remaining`
convert: always initialize attr_action in convert_attrs
Junio C Hamano [Sun, 10 Sep 2017 08:06:09 +0000 (17:06 +0900)]
RelNotes: further fixes for 2.14.2 from the master front
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano [Sun, 10 Sep 2017 08:03:10 +0000 (17:03 +0900)]
Merge branch 'jt/doc-pack-objects-fix' into maint
Doc updates.
* jt/doc-pack-objects-fix:
Doc: clarify that pack-objects makes packs, plural
Junio C Hamano [Sun, 10 Sep 2017 08:03:09 +0000 (17:03 +0900)]
Merge branch 'jn/vcs-svn-cleanup' into maint
Code clean-up.
* jn/vcs-svn-cleanup:
vcs-svn: move remaining repo_tree functions to fast_export.h
vcs-svn: remove repo_delete wrapper function
vcs-svn: remove custom mode constants
vcs-svn: remove more unused prototypes and declarations
Junio C Hamano [Sun, 10 Sep 2017 08:03:08 +0000 (17:03 +0900)]
Merge branch 'bc/vcs-svn-cleanup' into maint
Code clean-up.
* bc/vcs-svn-cleanup:
vcs-svn: rename repo functions to "svn_repo"
vcs-svn: remove unused prototypes
Junio C Hamano [Sun, 10 Sep 2017 08:03:07 +0000 (17:03 +0900)]
Merge branch 'jk/doc-the-this' into maint
Doc clean-up.
* jk/doc-the-this:
doc: fix typo in sendemail.identity
Junio C Hamano [Sun, 10 Sep 2017 08:03:07 +0000 (17:03 +0900)]
Merge branch 'rs/commit-h-single-parent-cleanup' into maint
Code clean-up.
* rs/commit-h-single-parent-cleanup:
commit: remove unused inline function single_parent()
Junio C Hamano [Sun, 10 Sep 2017 08:03:06 +0000 (17:03 +0900)]
Merge branch 'mg/format-ref-doc-fix' into maint
Doc fix.
* mg/format-ref-doc-fix:
Documentation/git-for-each-ref: clarify peeling of tags for --format
Documentation: use proper wording for ref format strings
Junio C Hamano [Sun, 10 Sep 2017 08:03:06 +0000 (17:03 +0900)]
Merge branch 'sb/submodule-parallel-update' into maint
Code clean-up.
* sb/submodule-parallel-update:
submodule.sh: remove unused variable
Junio C Hamano [Sun, 10 Sep 2017 08:03:05 +0000 (17:03 +0900)]
Merge branch 'hv/t5526-andand-chain-fix' into maint
Test fix.
* hv/t5526-andand-chain-fix:
t5526: fix some broken && chains
Junio C Hamano [Sun, 10 Sep 2017 08:03:04 +0000 (17:03 +0900)]
Merge branch 'sb/sha1-file-cleanup' into maint
Code clean-up.
* sb/sha1-file-cleanup:
sha1_file: make read_info_alternates static
Junio C Hamano [Sun, 10 Sep 2017 08:03:04 +0000 (17:03 +0900)]
Merge branch 'rs/t1002-do-not-use-sum' into maint
Test simplification.
* rs/t1002-do-not-use-sum:
t1002: stop using sum(1)
Junio C Hamano [Sun, 10 Sep 2017 08:03:03 +0000 (17:03 +0900)]
Merge branch 'ah/doc-empty-string-is-false' into maint
Doc update.
* ah/doc-empty-string-is-false:
doc: clarify "config --bool" behaviour with empty string
Junio C Hamano [Sun, 10 Sep 2017 08:03:02 +0000 (17:03 +0900)]
Merge branch 'rs/merge-microcleanup' into maint
Code clean-up.
* rs/merge-microcleanup:
merge: use skip_prefix()
Junio C Hamano [Sun, 10 Sep 2017 08:03:02 +0000 (17:03 +0900)]
Merge branch 'rs/find-pack-entry-bisection' into maint
Code clean-up.
* rs/find-pack-entry-bisection:
sha1_file: avoid comparison if no packed hash matches the first byte
Junio C Hamano [Sun, 10 Sep 2017 08:03:01 +0000 (17:03 +0900)]
Merge branch 'rs/apply-lose-prefix-length' into maint
Code clean-up.
* rs/apply-lose-prefix-length:
apply: remove prefix_length member from apply_state
Junio C Hamano [Sun, 10 Sep 2017 08:03:00 +0000 (17:03 +0900)]
Merge branch 'rj/add-chmod-error-message' into maint
Message fix.
* rj/add-chmod-error-message:
builtin/add: add detail to a 'cannot chmod' error message
Junio C Hamano [Sun, 10 Sep 2017 08:02:59 +0000 (17:02 +0900)]
Merge branch 'jk/hashcmp-memcmp' into maint
Code clean-up.
* jk/hashcmp-memcmp:
hashcmp: use memcmp instead of open-coded loop
Junio C Hamano [Sun, 10 Sep 2017 08:02:58 +0000 (17:02 +0900)]
Merge branch 'rs/t3700-clean-leftover' into maint
A test fix.
* rs/t3700-clean-leftover:
t3700: fix broken test under !POSIXPERM
Junio C Hamano [Sun, 10 Sep 2017 08:02:57 +0000 (17:02 +0900)]
Merge branch 'jc/perl-git-comment-typofix' into maint
A comment fix.
* jc/perl-git-comment-typofix:
perl/Git.pm: typofix in a comment
Junio C Hamano [Sun, 10 Sep 2017 08:02:56 +0000 (17:02 +0900)]
Merge branch 'mf/no-dashed-subcommands' into maint
Code clean-up.
* mf/no-dashed-subcommands:
scripts: use "git foo" not "git-foo"
Junio C Hamano [Sun, 10 Sep 2017 08:02:56 +0000 (17:02 +0900)]
Merge branch 'ab/ref-filter-no-contains' into maint
A test fix.
* ab/ref-filter-no-contains:
tests: don't give unportable ">" to "test" built-in, use -gt
Junio C Hamano [Sun, 10 Sep 2017 08:02:55 +0000 (17:02 +0900)]
Merge branch 'rs/archive-excluded-directory' into maint
"git archive" did not work well with pathspecs and the
export-ignore attribute.
We may want to resurrect the "we don't archive an empty directory"
bonus patch, but I do not mind merging the above early to 'next'
and leave it as a separate follow-up enhancement.
cf. <
20170820090629.tumvqwzkromcykjf@sigill.intra.peff.net>
* rs/archive-excluded-directory:
archive: don't queue excluded directories
archive: factor out helper functions for handling attributes
t5001: add tests for export-ignore attributes and exclude pathspecs
Junio C Hamano [Sun, 10 Sep 2017 08:02:55 +0000 (17:02 +0900)]
Merge branch 'mg/killed-merge' into maint
Killing "git merge --edit" before the editor returns control left
the repository in a state with MERGE_MSG but without MERGE_HEAD,
which incorrectly tells the subsequent "git commit" that there was
a squash merge in progress. This has been fixed.
* mg/killed-merge:
merge: save merge state earlier
merge: split write_merge_state in two
merge: clarify call chain
Documentation/git-merge: explain --continue
Junio C Hamano [Sun, 10 Sep 2017 08:02:55 +0000 (17:02 +0900)]
Merge branch 'tb/apply-with-crlf' into maint
"git apply" that is used as a better "patch -p1" failed to apply a
taken from a file with CRLF line endings to a file with CRLF line
endings. The root cause was because it misused convert_to_git()
that tried to do "safe-crlf" processing by looking at the index
entry at the same path, which is a nonsense---in that mode, "apply"
is not working on the data in (or derived from) the index at all.
This has been fixed.
* tb/apply-with-crlf:
apply: file commited with CRLF should roundtrip diff and apply
convert: add SAFE_CRLF_KEEP_CRLF
Junio C Hamano [Sun, 10 Sep 2017 08:02:55 +0000 (17:02 +0900)]
Merge branch 'cc/subprocess-handshake-missing-capabilities' into maint
When handshake with a subprocess filter notices that the process
asked for an unknown capability, Git did not report what program
the offending subprocess was running. This has been corrected.
We may want a follow-up fix to tighten the error checking, though.
* cc/subprocess-handshake-missing-capabilities:
sub-process: print the cmd when a capability is unsupported
Junio C Hamano [Sun, 10 Sep 2017 08:02:55 +0000 (17:02 +0900)]
Merge branch 'as/grep-quiet-no-match-exit-code-fix' into maint
"git grep -L" and "git grep --quiet -L" reported different exit
codes; this has been corrected.
* as/grep-quiet-no-match-exit-code-fix:
git-grep: correct exit code with --quiet and -L
Junio C Hamano [Sun, 10 Sep 2017 08:02:54 +0000 (17:02 +0900)]
Merge branch 'kd/stash-with-bash-4.4' into maint
bash 4.4 or newer gave a warning on NUL byte in command
substitution done in "git stash"; this has been squelched.
* kd/stash-with-bash-4.4:
stash: prevent warning about null bytes in input
Junio C Hamano [Sun, 10 Sep 2017 08:02:54 +0000 (17:02 +0900)]
Merge branch 'rs/win32-syslog-leakfix' into maint
Memory leak in an error codepath has been plugged.
* rs/win32-syslog-leakfix:
win32: plug memory leak on realloc() failure in syslog()
Junio C Hamano [Sun, 10 Sep 2017 08:02:53 +0000 (17:02 +0900)]
Merge branch 'rs/unpack-entry-leakfix' into maint
Memory leak in an error codepath has been plugged.
* rs/unpack-entry-leakfix:
sha1_file: release delta_stack on error in unpack_entry()
Junio C Hamano [Sun, 10 Sep 2017 08:02:52 +0000 (17:02 +0900)]
Merge branch 'rs/fsck-obj-leakfix' into maint
Memory leak in an error codepath has been plugged.
* rs/fsck-obj-leakfix:
fsck: free buffers on error in fsck_obj()
Junio C Hamano [Sun, 10 Sep 2017 08:02:52 +0000 (17:02 +0900)]
Merge branch 'ur/svn-local-zone' into maint
"git svn" used with "--localtime" option did not compute the tz
offset for the timestamp in question and instead always used the
current time, which has been corrected.
* ur/svn-local-zone:
git svn fetch: Create correct commit timestamp when using --localtime
Junio C Hamano [Sun, 10 Sep 2017 08:02:51 +0000 (17:02 +0900)]
Merge branch 'pw/am-signoff' into maint
"git am -s" has been taught that some input may end with a trailer
block that is not Signed-off-by: and it should refrain from adding
an extra blank line before adding a new sign-off in such a case.
* pw/am-signoff:
am: fix signoff when other trailers are present
Junio C Hamano [Sun, 10 Sep 2017 08:02:51 +0000 (17:02 +0900)]
Merge branch 'rs/in-obsd-basename-dirname-take-const' into maint
Portability fix.
* rs/in-obsd-basename-dirname-take-const:
test-path-utils: handle const parameter of basename and dirname
Junio C Hamano [Sun, 10 Sep 2017 08:02:51 +0000 (17:02 +0900)]
Merge branch 'rs/t4062-obsd' into maint
Test portability fix.
* rs/t4062-obsd:
t4062: use less than 256 repetitions in regex
Junio C Hamano [Sun, 10 Sep 2017 08:02:50 +0000 (17:02 +0900)]
Merge branch 'rs/obsd-getcwd-workaround' into maint
Test portability fix for BSDs.
* rs/obsd-getcwd-workaround:
t0001: skip test with restrictive permissions if getpwd(3) respects them
Junio C Hamano [Sun, 10 Sep 2017 08:02:49 +0000 (17:02 +0900)]
Merge branch 'bw/clone-recursive-quiet' into maint
"git clone --recurse-submodules --quiet" did not pass the quiet
option down to submodules.
* bw/clone-recursive-quiet:
clone: teach recursive clones to respect -q
Junio C Hamano [Sun, 10 Sep 2017 08:02:49 +0000 (17:02 +0900)]
Merge branch 'pw/sequence-rerere-autoupdate' into maint
Commands like "git rebase" accepted the --rerere-autoupdate option
from the command line, but did not always use it. This has been
fixed.
* pw/sequence-rerere-autoupdate:
cherry-pick/revert: reject --rerere-autoupdate when continuing
cherry-pick/revert: remember --rerere-autoupdate
t3504: use test_commit
rebase -i: honor --rerere-autoupdate
rebase: honor --rerere-autoupdate
am: remember --rerere-autoupdate setting
Junio C Hamano [Sun, 10 Sep 2017 08:02:49 +0000 (17:02 +0900)]
Merge branch 'bw/push-options-recursively-to-submodules' into maint
"git push --recurse-submodules $there HEAD:$target" was not
propagated down to the submodules, but now it is.
* bw/push-options-recursively-to-submodules:
submodule--helper: teach push-check to handle HEAD
Junio C Hamano [Sun, 10 Sep 2017 08:02:48 +0000 (17:02 +0900)]
Merge branch 'ma/pager-per-subcommand-action' into maint
The "tag.pager" configuration variable was useless for those who
actually create tag objects, as it interfered with the use of an
editor. A new mechanism has been introduced for commands to enable
pager depending on what operation is being carried out to fix this,
and then "git tag -l" is made to run pager by default.
If this works out OK, I think there are low-hanging fruits in
other commands like "git branch" that outputs long list in one mode
while taking input in another.
* ma/pager-per-subcommand-action:
git.c: ignore pager.* when launching builtin as dashed external
tag: change default of `pager.tag` to "on"
tag: respect `pager.tag` in list-mode only
t7006: add tests for how git tag paginates
git.c: provide setup_auto_pager()
git.c: let builtins opt for handling `pager.foo` themselves
builtin.h: take over documentation from api-builtin.txt
Junio C Hamano [Sun, 10 Sep 2017 08:02:48 +0000 (17:02 +0900)]
Merge branch 'jk/rev-list-empty-input' into maint
"git log --tag=no-such-tag" showed log starting from HEAD, which
has been fixed---it now shows nothing.
* jk/rev-list-empty-input:
revision: do not fallback to default when rev_input_given is set
rev-list: don't show usage when we see empty ref patterns
revision: add rev_input_given flag
t6018: flesh out empty input/output rev-list tests