{"push_id":788260594,"size":6,"distinct_size":0,"ref":"refs/heads/maint-2.2","head":"441c4a40173fe1ee8a5c0094e587dfc47e2a6460","before":"fdf96a20acf96a6ac538df8113b2aafd6ed71d50","commits":[{"sha":"f514ef9787f320287d7ba71f2965127b9d8b3832","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"verify_absent: allow filenames longer than PATH_MAX\n\nWhen unpack-trees wants to know whether a path will\noverwrite anything in the working tree, we use lstat() to\nsee if there is anything there. But if we are going to write\n\"foo/bar\", we can't just lstat(\"foo/bar\"); we need to look\nfor leading prefixes (e.g., \"foo\"). So we use the lstat cache\nto find the length of the leading prefix, and copy the\nfilename up to that length into a temporary buffer (since\nthe original name is const, we cannot just stick a NUL in\nit).\n\nThe copy we make goes into a PATH_MAX-sized buffer, which\nwill overflow if the prefix is longer than PATH_MAX. How\nthis happens is a little tricky, since in theory PATH_MAX is\nthe biggest path we will have read from the filesystem. But\nthis can happen if:\n\n  - the compiled-in PATH_MAX does not accurately reflect\n    what the filesystem is capable of\n\n  - the leading prefix is not _quite_ what is on disk; it\n    contains the next element from the name we are checking.\n    So if we want to write \"aaa/bbb/ccc/ddd\" and \"aaa/bbb\"\n    exists, the prefix of interest is \"aaa/bbb/ccc\". If\n    \"aaa/bbb\" approaches PATH_MAX, then \"ccc\" can overflow\n    it.\n\nSo this can be triggered, but it's hard to do. In\nparticular, you cannot just \"git clone\" a bogus repo. The\nverify_absent checks happen before unpack-trees writes\nanything to the filesystem, so there are never any leading\nprefixes during the initial checkout, and the bug doesn't\ntrigger. And by definition, these files are larger than\nPATH_MAX, so writing them will fail, and clone will\ncomplain (though it may write a partial path, which will\ncause a subsequent \"git checkout\" to hit the bug).\n\nWe can fix it by creating the temporary path on the heap.\nThe extra malloc overhead is not important, as we are\nalready making at least one stat() call (and probably more\nfor the prefix discovery).\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/f514ef9787f320287d7ba71f2965127b9d8b3832"},{"sha":"c29edfefb6f6a3fef80172c16bcc34c826d417b0","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"notes: use a strbuf in add_non_note\n\nWhen we are loading a notes tree into our internal hash\ntable, we also collect any files that are clearly non-notes.\nWe format the name of the file into a PATH_MAX buffer, but\nunlike true notes (which cannot be larger than a fanned-out\nsha1 hash), these tree entries can be arbitrarily long,\noverflowing our buffer.\n\nWe can fix this by switching to a strbuf. It doesn't even\ncost us an extra allocation, as we can simply hand ownership\nof the buffer over to the non-note struct.\n\nThis is of moderate security interest, as you might fetch\nnotes trees from an untrusted remote. However, we do not do\nso by default, so you would have to manually fetch into the\nnotes namespace.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/c29edfefb6f6a3fef80172c16bcc34c826d417b0"},{"sha":"5015f01c12a45a1042c1aa6b6f7f6b62bfa00ade","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"read_info_alternates: handle paths larger than PATH_MAX\n\nThis function assumes that the relative_base path passed\ninto it is no larger than PATH_MAX, and writes into a\nfixed-size buffer. However, this path may not have actually\ncome from the filesystem; for example, add_submodule_odb\ngenerates a path using a strbuf and passes it in. This is\nhard to trigger in practice, though, because the long\nsubmodule directory would have to exist on disk before we\nwould try to open its info/alternates file.\n\nWe can easily avoid the bug, though, by simply creating the\nfilename on the heap.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/5015f01c12a45a1042c1aa6b6f7f6b62bfa00ade"},{"sha":"78f23bdf68dae56d644892990484951583a64014","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"show-branch: use a strbuf for reflog descriptions\n\nWhen we show \"branch@{0}\", we format into a fixed-size\nbuffer using sprintf. This can overflow if you have long\nbranch names. We can fix it by using a temporary strbuf.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/78f23bdf68dae56d644892990484951583a64014"},{"sha":"f54cb059b18e704d8b51d0cd4736344422650d6f","author":{"email":"a6723cc3f76163bf7adb636a73ac3b0ceb3e6b9b@pobox.com","name":"Junio C Hamano"},"message":"Merge branch 'jk/long-paths' into maint-2.2","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/f54cb059b18e704d8b51d0cd4736344422650d6f"},{"sha":"441c4a40173fe1ee8a5c0094e587dfc47e2a6460","author":{"email":"a6723cc3f76163bf7adb636a73ac3b0ceb3e6b9b@pobox.com","name":"Junio C Hamano"},"message":"Git 2.2.3\n\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/441c4a40173fe1ee8a5c0094e587dfc47e2a6460"}]}