There is a format string vulnerability introduced with the packed refs
file format.
Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This was lost in the packed-ref updates. The original test was a bit
dubious, so I cleaned that up, too. It fixes the case when the current HEAD
is refs/heads/bla/master: the original test was true for both bla/master
_and_ master.
However, it shares a hard-to-fix bug with the original test: if the current
HEAD is refs/heads/master, and there is a branch refs/heads/heads/master,
then both are marked active.
Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
It called read_ref(git_path(..)..), where read_ref does the git_path()
stuff itself.
Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
Signed-off-by: Junio C Hamano <junkio@cox.net>
"git pack-refs --prune", after successfully packing the existing
refs, removes the loose ref files. It tries to protect against
race by doing the usual lock_ref_sha1() which makes sure the
contents of the ref has not changed since we last looked at.
Also we do not bother trying to prune what was already packed, and
we do not try pruning symbolic refs.
Signed-off-by: Junio C Hamano <junkio@cox.net>
This adds a "int *flag" parameter to resolve_ref() and makes
for_each_ref() family to call callback function with an extra
"int flag" parameter. They are used to give two bits of
information (REF_ISSYMREF and REF_ISPACKED) about the ref.
Signed-off-by: Junio C Hamano <junkio@cox.net>
This is a long overdue fix to the API for for_each_ref() family
of functions. It allows the callers to specify a callback data
pointer, so that the caller does not have to use static
variables to communicate with the callback funciton.
The updated for_each_ref() family takes a function of type
int (*fn)(const char *, const unsigned char *, void *)
and a void pointer as parameters, and calls the function with
the name of the ref and its SHA-1 with the caller-supplied void
pointer as parameters.
The commit updates two callers, builtin-name-rev.c and
builtin-pack-refs.c as an example.
Signed-off-by: Junio C Hamano <junkio@cox.net>
An earlier conversion accidentally hardcoded "HEAD" to be passed to
resolve_ref(), thereby causing git-symbolic-ref command to always
report where the HEAD points at, ignoring the command line parameter.
Signed-off-by: Junio C Hamano <junkio@cox.net>
Current git#next is totally broken wrt. cloning over HTTP, generating refs
at random directories. Of course it's caused by the static get_pathname()
buffer. lock_ref_sha1() stores return value of mkpath()'s get_pathname()
call, then calls lock_ref_sha1_basic() which calls git_path(ref) which
calls get_pathname() at that point returning pointer to the same buffer.
So now you are sprintf()ing a format string into itself, wow! The resulting
pathnames are really cute. (If you've been paying attention, yes, the
mere fact that a format string _could_ write over itself is very wrong
and probably exploitable here. See the other mail I've just sent.)
I've never liked how we use return values of those functions so liberally,
the "allow some random number of get_pathname() return values to work
concurrently" is absolutely horrible pit and we've already fallen in this
before IIRC. I consider it an awful coding practice, you add a call
somewhere and at some other point some distant caller of that breaks since
it reuses the same return values. Not to mention this takes quite some time
to debug.
My gut feeling tells me that there might be more of this. I don't have
time to review the rest of the users of the refs.c functions though.
Signed-off-by: Petr Baudis <pasky@suse.cz>
Signed-off-by: Junio C Hamano <junkio@cox.net>
It depended on specific error messages to detect failure but the
implementation changed and broke the test. This fixes the breakage
minimally.
Signed-off-by: Junio C Hamano <junkio@cox.net>
This actually "turns on" the packed ref file format, now that the
infrastructure to do so sanely exists (ie notably the change to make the
reference reading logic take refnames rather than pathnames to the loose
objects that no longer necessarily even exist).
In particular, when the ref lookup hits a refname that has no loose file
associated with it, it falls back on the packed-ref information. Also, the
ref-locking code, while still using a loose file for the locking itself
(and _creating_ a loose file for the new ref) no longer requires that the
old ref be in such an unpacked state.
Finally, this does a minimal hack to git-checkout.sh to rather than check
the ref-file directly, do a "git-rev-parse" on the "heads/$refname".
That's not really wonderful - we should rather really have a special
routine to verify the names as proper branch head names, but it is a
workable solution for now.
With this, I can literally do something like
git pack-refs
find .git/refs -type f -print0 | xargs -0 rm -f --
and the end result is a largely working repository (ie I've done two
commits - which creates _one_ unpacked ref file - done things like run
"gitk" and "git log" etc, and it all looks ok).
There are probably things missing, but I'm hoping that the missing things
are now of the "small and obvious" kind, and that somebody else might want
to start looking at this too. Hint hint ;)
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
The old code used to totally mix up the notion of a ref-name and the path
that that ref was associated with. That was not only horribly ugly (a
number of users got the path, and then wanted to try to turn it back into
a ref-name again), but it fundamnetally doesn't work at all once we do any
setup where a ref doesn't have a 1:1 relationship with a particular
pathname.
This fixes things up so that we use the ref-name throughout, and only
turn it into a pathname once we actually look it up in the filesystem.
That makes a lot of things much clearer and more straightforward.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
You can remove a ref that is packed two different ways: either simply
repack all the refs without that one, or create a loose ref that has the
magic all-zero SHA1.
This also adds back the test that a ref actually has the object it
points to.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This also adds some very rudimentary support for the notion of packed
refs. HOWEVER! At this point it isn't used to actually look up a ref
yet, only for listing them (ie "for_each_ref()" and friends see the
packed refs, but none of the other single-ref lookup routines).
Note how we keep two separate lists: one for the loose refs, and one for
the packed refs we read. That's so that we can easily keep the two apart,
and read only one set or the other (and still always make sure that the
loose refs take precedence).
[ From this, it's not actually obvious why we'd keep the two separate
lists, but it's important to have the packed refs on their own list
later on, when I add support for looking up a single loose one.
For that case, we will want to read _just_ the packed refs in case the
single-ref lookup fails, yet we may end up needing the other list at
some point in the future, so keeping them separated is important ]
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
* jc/pack:
pack-objects: document --revs, --unpacked and --all.
pack-objects --unpacked=<existing pack> option.
pack-objects: further work on internal rev-list logic.
pack-objects: run rev-list equivalent internally.
Separate object listing routines out of rev-list
* jk/diff:
wt-status: remove extraneous newline from 'deleted:' output
git-status: document colorization config options
Teach runstatus about --untracked
git-commit.sh: convert run_status to a C builtin
Move color option parsing out of diff.c and into color.[ch]
diff: support custom callbacks for output
Currently it is possible to give any string ending with a number as
page. -1 for example is quite bad (error log shows probably 100
warnings).
Signed-off-by: Junio C Hamano <junkio@cox.net>
The current code works like this: if others flags than POLLIN is
raised we assume that (a) something bad happened and the child died or
(b) the child has closed the pipe because it had no more data to send.
For the latter case, we assume wrongly that one call to
process_input() will empty the pipe. Indeed it reads only 16Ko of data
by call and the the pipe capacity can be larger than that (on current
Linux kernel, it is 65536 bytes). Therefore the child can write 32ko
of data, for example, and close the pipe. After that poll will return
POLLIN _and_ POLLHUP and the parent will read only 16ko of data.
This patch forces the parent to empty the pipe as soon as POLLIN is
raised and even if POLLHUP or something else is raised too.
Moreover, some implementations of poll might return POLLRDNORM flag
even if it is non standard.
Signed-off-by: Franck Bui-Huu <vagabon.xyz@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
* jc/archive:
git-tar-tree: devolve git-tar-tree into a wrapper for git-archive
git-archive: inline default_parse_extra()
builtin-archive.c: rename remote_request() to extract_remote_arg()
upload-archive: monitor child communication more carefully.
Add sideband status report to git-archive protocol
Prepare larger packet buffer for upload-pack protocol.
Teach --exec to git-archive --remote
Add --verbose to git-archive
archive: force line buffered output to stderr
Use xstrdup instead of strdup in builtin-{tar,zip}-tree.c
Move sideband server side support into reusable form.
Move sideband client side support into reusable form.
archive: allow remote to have more formats than we understand.
git-archive: make compression level of ZIP archives configurable
Add git-upload-archive
git-archive: wire up ZIP format.
git-archive: wire up TAR format.
Add git-archive
$export_ok: If this variable evaluates to true it is checked
if a file with this name exists in the repository. If it
does not exist the repository cannot be viewed from gitweb.
(Similar to git-daemon-export-ok for git-daemon).
$strict_export: If this variable evaluates to true only
repositories listed on the project-list-page of gitweb can
be accessed.
Signed-off-by: Junio C Hamano <junkio@cox.net>
This patch removes the custom tree walker tree_traverse(), and makes
generate_tar() use write_tar_archive() and the infrastructure provided
by git-archive instead.
As a kind of side effect, make write_tar_archive() able to handle NULL
as base directory, as this is what the new and simple generate_tar()
uses to indicate the absence of a base directory. This was simpler
and cleaner than playing tricks with empty strings.
The behaviour of git-tar-tree should be unchanged (quick tests didn't
indicate otherwise) except for the text of some error messages.
Signed-off-by: Rene Scharfe <rene.scharfe@lsrfire.ath.cx>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Perl spit out a varning when "blob" or "blob_plain" actions were
used without a $hash parameter.
Signed-off-by: Martin Waitz <tali@admingilde.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Now three types of path based URLs are supported:
gitweb.cgi/project.git
gitweb.cgi/project.git/branch
gitweb.cgi/project.git/branch/filename
The first one (show project summary) was already supported for a long time
now. The other two are new: they show the shortlog of a branch or
the plain file contents of some file contained in the repository.
This is especially useful to support project web pages for small
projects: just create an html branch and then use an URL like
gitweb.cgi/project.git/html/index.html.
Signed-off-by: Martin Waitz <tali@admingilde.org>
Acked-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
In "git-apply", we have a few sanity checks and heuristics that
expects that the patch fed to us is a unified diff with at least
one line of context.
* When there is no leading context line in a hunk, the hunk
must apply at the beginning of the preimage. Similarly, no
trailing context means that the hunk is anchored at the end.
* We learn a patch deletes the file from a hunk that has no
resulting line (i.e. all lines are prefixed with '-') if it
has not otherwise been known if the patch deletes the file.
Similarly, no old line means the file is being created.
And we declare an error condition when the file created by a
creation patch already exists, and/or when a deletion patch
still leaves content in the file.
These sanity checks are good safety measures, but breaks down
when people feed a diff generated with --unified=0. This was
recently noticed first by Matthew Wilcox and Gerrit Pape.
This adds a new flag, --unified-zero, to allow bypassing these
checks. If you are in control of the patch generation process,
you should not use --unified=0 patch and fix it up with this
flag; rather you should try work with a patch with context. But
if all you have to work with is a patch without context, this
flag may come handy as the last resort.
Signed-off-by: Junio C Hamano <junkio@cox.net>
I had a hard time figuring out why this test was failing with
the packed-refs update without running it under "sh -x". This
makes output from "sh t1400-update-ref.sh -v" more descriptive.
Updating other tests would be a good janitorial task.
Signed-off-by: Junio C Hamano <junkio@cox.net>
Based on Sasha Khapyorsky's patch but adjusted to the refactored
"missing target" detection code.
It might have been better if the program were called
git-url-fetch but it is too late now ;-).
Signed-off-by: Junio C Hamano <junkio@cox.net>
At a handful places we check two error codes from curl library
to see if the file we asked was missing from the remote (e.g.
we asked for a loose object when it is in a pack) to decide what
to do next. This consolidates the check into a single function.
NOTE: the original did not check for HTTP_RETURNED_ERROR when
error code is 404, but this version does to make sure 404 is
from HTTP and not some other protcol.
Signed-off-by: Junio C Hamano <junkio@cox.net>
An earlier commit cbd64af added a check that prevents "git-am"
to run without its standard input connected to a terminal while
resuming operation. This was to catch a user error to try
feeding a new patch from its standard input while recovery.
The assumption of the check was that it is an indication that a
new patch is being fed if the standard input is not connected to
a terminal. It is however not quite correct (the standard input
can be /dev/null if the user knows the operation does not need
any input, for example). This broke t3403 when the test was run
with its standard input connected to /dev/null.
When git-am is given an explicit command such as --skip, there
is no reason to insist that the standard input is a terminal; we
are not going to read a new patch anyway.
Credit goes to Gerrit Pape for noticing and reporting the
problem with t3403-rebase-skip test.
Signed-off-by: Junio C Hamano <junkio@cox.net>
This allows you to maintain a few filesystem pathnames concurrently, by
simply replacing the single static "pathname" buffer with a LRU of four
buffers.
We did exactly the same thing with sha1_to_hex(), for pretty much exactly
the same reason. Sometimes you want to use two pathnames, and while it's
easy enough to xstrdup() them, why not just do the LU buffer thing.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Add link to "project_index" view as [TXT] beside link to "opml" view,
(which is marked by [OPML]) to "project_list" page.
While at it add alternate links for "opml" and "project_list" to HTML
header for "project_list" view.
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Make it possible to use href() subroutine to generate link with
query string which does not include project ('p') parameter.
href() used to add project=$project to its parameters, if it
was not set (to be more exact if $params{'project'} was false).
Now you can pass "project => undef" if you don't want for href()
to add project parameter to query string in the generated link.
Links to "project_list", "project_index" and "opml" (all related
to list of all projects/all git repositories) doesn't need project
parameter. Moreover "project_list" is default view (action) if
project ('p') parameter is not set, just like "summary" is default
view (action) if project is set; project list served as a kind
of "home" page for gitweb instalation, and links to "project_list"
view were done without specyfying it as an action.
Convert remaining links (except $home_link and anchor links)
to use href(); this required adding 'order => "o"' to @mapping
in href(). This finishes consolidation of URL generation.
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Add git_project_index, which generates index.aux file that can be used
as a source of projects list, instead of generating projects list from
a directory. Using file as a source of projects list allows for some
projects to be not present in gitweb main (project_list) page, and/or
correct project owner info. And is probably faster.
Additionally it can be used to get the list of all available repositories
for scripts (in easily parseable form).
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
This is in response to Linus's work on packed refs. Additionally it
makes gitweb work with symrefs, too.
Do not parse refs by hand, using File::Find and reading individual
heads to get hash of reference, but use git-peek-remote output
instead. Assume that the hash for deref (with ^{}) always follows hash
for ref, and that we have derefs only for tag objects; this removes
call to git_get_type (and git-cat-file -t invocation) for tags, which
speeds "summary" and "tags" views generation, but might slow generation
of "heads" view a bit. For now, we do not save and use the deref hash.
Remove git_get_hash_by_ref while at it, as git_get_refs_list was the
only place it was used.
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
Earlier code to get list of projects when $projects_list is a
directory (e.g. when it is equal to $projectroot) had a hardcoded flat
(one level) list of directories. Allow for projects to be in
subdirectories also for $projects_list being a directory by using
File::Find.
Signed-off-by: Jakub Narebski <jnareb@gmail.com>
Signed-off-by: Junio C Hamano <junkio@cox.net>
describe, git: Handle argc==0 case the same way as argc==1.
merge-tree: Refuse excessive arguments.
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
It turns out that I actually wanted to avoid the filenames (because I
didn't care - I just wanted to see the context in which something was
used) when doing a grep. But since "git grep" didn't take the "-h"
parameter, I ended up having to do "grep -5 -h *.c" instead.
So here's a trivial patch that adds "-h" (and thus has to enable -H too)
to "git grep" parsing.
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Junio C Hamano <junkio@cox.net>
