summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2021-03-15xcalloc: use CALLOC_ARRAY() when applicableLibravatar Junio C Hamano2-6/+4
These are for codebase before Git 2.31 Signed-off-by: Junio C Hamano <gitster@pobox.com>
2021-02-12Git 2.27.1Libravatar Johannes Schindelin3-2/+9
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.26.3Libravatar Johannes Schindelin19-4/+263
* maint-2.26: Git 2.26.3 Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.26.3Libravatar Johannes Schindelin3-2/+9
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.25.5Libravatar Johannes Schindelin18-4/+256
* maint-2.25: Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.25.5Libravatar Johannes Schindelin3-2/+9
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.24.4Libravatar Johannes Schindelin17-4/+249
* maint-2.24: Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.24.4Libravatar Johannes Schindelin3-2/+9
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.23.4Libravatar Johannes Schindelin16-4/+242
* maint-2.23: Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.23.4Libravatar Johannes Schindelin3-2/+9
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.22.5Libravatar Johannes Schindelin15-4/+235
* maint-2.22: Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.22.5Libravatar Johannes Schindelin3-2/+9
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.21.4Libravatar Johannes Schindelin14-4/+228
* maint-2.21: Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.21.4Libravatar Johannes Schindelin3-2/+8
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.20.5Libravatar Johannes Schindelin13-4/+222
* maint-2.20: Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.20.5Libravatar Johannes Schindelin3-2/+8
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.19.6Libravatar Johannes Schindelin12-4/+216
* maint-2.19: Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.19.6Libravatar Johannes Schindelin3-2/+8
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.18.5Libravatar Johannes Schindelin11-4/+210
* maint-2.18: Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.18.5Libravatar Johannes Schindelin3-2/+8
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12Sync with 2.17.6Libravatar Johannes Schindelin10-4/+204
* maint-2.17: Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path
2021-02-12Git 2.17.6Libravatar Johannes Schindelin3-2/+18
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12unpack_trees(): start with a fresh lstat cacheLibravatar Matheus Tavares1-0/+3
We really want to avoid relying on stale information. Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12run-command: invalidate lstat cache after a command finishedLibravatar Johannes Schindelin2-1/+44
In the previous commit, we intercepted calls to `rmdir()` to invalidate the lstat cache in the successful case, so that the lstat cache could not have the idea that a directory exists where there is none. The same situation can arise, of course, when a separate process is spawned (most notably, this is the case in `submodule_move_head()`). Obviously, we cannot know whether a directory was removed in that process, therefore we must invalidate the lstat cache afterwards. Note: in contrast to `lstat_cache_aware_rmdir()`, we invalidate the lstat cache even in case of an error: the process might have removed a directory and still have failed afterwards. Co-authored-by: Matheus Tavares <matheus.bernardino@usp.br> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2021-02-12checkout: fix bug that makes checkout follow symlinks in leading pathLibravatar Matheus Tavares7-3/+141
Before checking out a file, we have to confirm that all of its leading components are real existing directories. And to reduce the number of lstat() calls in this process, we cache the last leading path known to contain only directories. However, when a path collision occurs (e.g. when checking out case-sensitive files in case-insensitive file systems), a cached path might have its file type changed on disk, leaving the cache on an invalid state. Normally, this doesn't bring any bad consequences as we usually check out files in index order, and therefore, by the time the cached path becomes outdated, we no longer need it anyway (because all files in that directory would have already been written). But, there are some users of the checkout machinery that do not always follow the index order. In particular: checkout-index writes the paths in the same order that they appear on the CLI (or stdin); and the delayed checkout feature -- used when a long-running filter process replies with "status=delayed" -- postpones the checkout of some entries, thus modifying the checkout order. When we have to check out an out-of-order entry and the lstat() cache is invalid (due to a previous path collision), checkout_entry() may end up using the invalid data and thrusting that the leading components are real directories when, in reality, they are not. In the best case scenario, where the directory was replaced by a regular file, the user will get an error: "fatal: unable to create file 'foo/bar': Not a directory". But if the directory was replaced by a symlink, checkout could actually end up following the symlink and writing the file at a wrong place, even outside the repository. Since delayed checkout is affected by this bug, it could be used by an attacker to write arbitrary files during the clone of a maliciously crafted repository. Some candidate solutions considered were to disable the lstat() cache during unordered checkouts or sort the entries before passing them to the checkout machinery. But both ideas include some performance penalty and they don't future-proof the code against new unordered use cases. Instead, we now manually reset the lstat cache whenever we successfully remove a directory. Note: We are not even checking whether the directory was the same as the lstat cache points to because we might face a scenario where the paths refer to the same location but differ due to case folding, precomposed UTF-8 issues, or the presence of `..` components in the path. Two regression tests, with case-collisions and utf8-collisions, are also added for both checkout-index and delayed checkout. Note: to make the previously mentioned clone attack unfeasible, it would be sufficient to reset the lstat cache only after the remove_subtree() call inside checkout_entry(). This is the place where we would remove a directory whose path collides with the path of another entry that we are currently trying to check out (possibly a symlink). However, in the interest of a thorough fix that does not leave Git open to similar-but-not-identical attack vectors, we decided to intercept all `rmdir()` calls in one fell swoop. This addresses CVE-2021-21300. Co-authored-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br>
2020-05-31Git 2.27Libravatar Junio C Hamano1-1/+1
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-05-31Merge branch 'cb/test-use-ere-for-alternation'Libravatar Junio C Hamano2-2/+2
Portability fix for tests added recently. * cb/test-use-ere-for-alternation: t: avoid alternation (not POSIX) in grep's BRE
2020-05-31Merge tag 'l10n-2.27.0-rnd2' of git://github.com/git-l10n/git-poLibravatar Junio C Hamano12-43116/+47435
l10n-2.27.0-rnd2 * tag 'l10n-2.27.0-rnd2' of git://github.com/git-l10n/git-po: (23 commits) l10n: zh_TW.po: v2.27.0 round 2 (0 untranslated) l10n: zh_TW.po: v2.27.0 round 1 (0 untranslated) l10n: de.po: Fix typo in the German translation of octopus l10n: de.po: Update German translation for Git 2.27.0 l10n: it.po: update for Git 2.27.0 round #2 l10n: tr: v2.27.0 round 2 l10n: fr.po v2.27.0 rnd 2 l10n: bg.po: Updated Bulgarian translation (4875t) l10n: Update Catalan translation l10n: sv.po: Update Swedish translation (4875t0f0u) l10n: vi(4875t): Updated Vietnamses translation for 2.27.0rd2 l10n: zh_CN: for git v2.27.0 l10n round 1~2 l10n: git.pot: v2.27.0 round 2 (+1) l10n: Update Catalan translation l10n: vi(4874t): Updated Vietnamses translation for 2.27.0 l10n: es: 2.27.0 round 1 l10n: bg.po: Updated Bulgarian translation (4868t) l10n: fr v2.27.0 rnd 1 l10n: sv.po: Update Swedish translation (4839t0f0u) l10n: tr: v2.27.0 round 1 ...
2020-05-30Merge branch 'master' of github.com:ruester/git-po-deLibravatar Jiang Xin1-3445/+3685
* 'master' of github.com:ruester/git-po-de: l10n: de.po: Fix typo in the German translation of octopus l10n: de.po: Update German translation for Git 2.27.0
2020-05-30Merge branch of github.com:AlessandroMenti/git-poLibravatar Jiang Xin1-122/+129
* 'update-italian-translation' of github.com:AlessandroMenti/git-po: l10n: it.po: update for Git 2.27.0 round #2
2020-05-29Merge branch 'bc/sha-256-part-1-of-4'Libravatar Junio C Hamano1-1/+1
Docfix. * bc/sha-256-part-1-of-4: Documentation: correct hash environment variable
2020-05-29Merge branch 'ma/rev-list-options-docfix'Libravatar Junio C Hamano1-16/+19
Docfix. * ma/rev-list-options-docfix: rev-list-options.txt: start a list for `show-pulls`
2020-05-29Merge branch 'jk/ci-only-on-selected-branches'Libravatar Junio C Hamano1-2/+3
Dev support. * jk/ci-only-on-selected-branches: ci/config: correct instruction for CI preferences
2020-05-29t: avoid alternation (not POSIX) in grep's BRELibravatar Carlo Marcelo Arenas Belón2-2/+2
f1e3df3169 (t: increase test coverage of signature verification output, 2020-03-04) adds GPG dependent tests to t4202 and t6200 that were found problematic with at least OpenBSD 6.7. Using an escaped '|' for alternations works only in some implementations of grep (e.g. GNU and busybox). It is not part of POSIX[1] and not supported by some BSD, macOS, and possibly other POSIX compatible implementations. Use `grep -E`, and write it using extended regular expression. [1] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html#tag_09_03 Helped-by: Torsten Bögershausen <tboegi@web.de> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-05-30l10n: zh_TW.po: v2.27.0 round 2 (0 untranslated)Libravatar Yi-Jyun Pan1-103/+107
Signed-off-by: Yi-Jyun Pan <pan93412@gmail.com>
2020-05-30l10n: zh_TW.po: v2.27.0 round 1 (0 untranslated)Libravatar Yi-Jyun Pan1-3587/+4088
Signed-off-by: Yi-Jyun Pan <pan93412@gmail.com>
2020-05-29l10n: de.po: Fix typo in the German translation of octopusLibravatar Jan Engelhardt1-1/+1
Signed-off-by: Jan Engelhardt <jengelh@inai.de> Signed-off-by: Matthias Rüster <matthias.ruester@gmail.com>
2020-05-29l10n: de.po: Update German translation for Git 2.27.0Libravatar Matthias Rüster1-3444/+3684
Reviewed-by: Ralf Thielow <ralf.thielow@gmail.com> Signed-off-by: Matthias Rüster <matthias.ruester@gmail.com>
2020-05-28l10n: it.po: update for Git 2.27.0 round #2Libravatar Alessandro Menti1-122/+129
Signed-off-by: Alessandro Menti <alessandro.menti@alessandromenti.it>
2020-05-28Merge branch 'fr_2.27.0rnd2' of github.com:jnavila/gitLibravatar Jiang Xin1-103/+107
* 'fr_2.27.0rnd2' of github.com:jnavila/git: l10n: fr.po v2.27.0 rnd 2
2020-05-28Merge branch 'master' of github.com:bitigchi/git-poLibravatar Jiang Xin1-114/+116
* 'master' of github.com:bitigchi/git-po: l10n: tr: v2.27.0 round 2
2020-05-28Merge branch 'master' of github.com:alshopov/git-poLibravatar Jiang Xin1-1096/+976
* 'master' of github.com:alshopov/git-po: l10n: bg.po: Updated Bulgarian translation (4875t)
2020-05-28Merge branch 'master' of github.com:Softcatala/git-poLibravatar Jiang Xin1-390/+179
* 'master' of github.com:Softcatala/git-po: l10n: Update Catalan translation
2020-05-27Documentation: correct hash environment variableLibravatar Toon Claes1-1/+1
To set the default hash algorithm you can set the `GIT_DEFAULT_HASH` environment variable. In the documentation this variable is named `GIT_DEFAULT_HASH_ALGORITHM`, which is incorrect. Signed-off-by: Toon Claes <toon@iotcl.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2020-05-27l10n: tr: v2.27.0 round 2Libravatar Emir Sarı1-114/+116
Signed-off-by: Emir Sarı <bitigchi@me.com>
2020-05-27l10n: fr.po v2.27.0 rnd 2Libravatar Jean-Noël Avila1-103/+107
Signed-off-by: Jean-Noël Avila <jn.avila@free.fr>
2020-05-27l10n: bg.po: Updated Bulgarian translation (4875t)Libravatar Alexander Shopov1-1096/+976
Signed-off-by: Alexander Shopov <ash@kambanaria.org>
2020-05-27l10n: Update Catalan translationLibravatar Jordi Mas1-390/+179
Signed-off-by: Jordi Mas <jmas@softcatala.org>
2020-05-27l10n: sv.po: Update Swedish translation (4875t0f0u)Libravatar Peter Krefting1-103/+107
Signed-off-by: Peter Krefting <peter@softwolves.pp.se>
2020-05-27l10n: vi(4875t): Updated Vietnamses translation for 2.27.0rd2Libravatar Tran Ngoc Quan1-110/+114
Signed-off-by: Tran Ngoc Quan <vnwildman@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-28 10:25:27 +0000