{"push_id":816120826,"size":75,"distinct_size":0,"ref":"refs/heads/dt/refs-backend-lmdb","head":"3608a0fbbac7eee99ee1e64ff7657f4f9eaf073d","before":"9cb87b13e57ae301eaf9d1dd5166abbb53a092ce","commits":[{"sha":"e2b021eb5b5ce2f4be3c10f1f8063981b1a53053","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"precompose_utf8: drop unused variable\n\nThe result of iconv is assigned to a variable, but we never\nuse it (instead, we check errno and whether the function\nconsumed all bytes). Let's drop the assignment, as it\ntriggers gcc's -Wunused-but-set-variable.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/e2b021eb5b5ce2f4be3c10f1f8063981b1a53053"},{"sha":"fdf729661a777d8bd598f40055d92b2df5601332","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"probe_utf8_pathname_composition: use internal strbuf\n\nWhen we are initializing a .git directory, we may call\nprobe_utf8_pathname_composition to detect utf8 mangling. We\npass in a path buffer for it to use, and it blindly\nstrcpy()s into it, not knowing whether the buffer is large\nenough to hold the result or not.\n\nIn practice this isn't a big deal, because the buffer we\npass in already contains \"$GIT_DIR/config\", and we append\nonly a few extra bytes to it. But we can easily do the right\nthing just by calling git_path_buf ourselves. Technically\nthis results in a different pathname (before we appended our\nutf8 characters to the \"config\" path, and now they get their\nown files in $GIT_DIR), but that should not matter for our\npurposes.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/fdf729661a777d8bd598f40055d92b2df5601332"},{"sha":"9c28390bda4bb86f48a3145417c1cb1892782c47","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"init: use strbufs to store paths\n\nThe init code predates strbufs, and uses PATH_MAX-sized\nbuffers along with many manual checks on intermediate sizes\n(some of which make magic assumptions, such as that init\nwill not create a path inside .git longer than 50\ncharacters).\n\nWe can simplify this greatly by using strbufs, which drops\nsome hard-to-verify strcpy calls in favor of git_path_buf.\nWhile we're in the area, let's also convert existing calls\nto git_path to the safer git_path_buf (our existing calls\nwere passed to pretty tame functions, and so were not a\nproblem, but it's easy to be consistent and safe here).\n\nNote that we had an explicit test that \"git init\" rejects\nlong template directories. This comes from 32d1776 (init: Do\nnot segfault on big GIT_TEMPLATE_DIR environment variable,\n2009-04-18). We can drop the test_must_fail here, as we now\naccept this and need only confirm that we don't segfault,\nwhich was the original point of the test.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/9c28390bda4bb86f48a3145417c1cb1892782c47"},{"sha":"6c31c22cebe9f0b117fd93ee7792d88e82aaa61e","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"apply: convert root string to strbuf\n\nWe use manual computation and strcpy to allocate the \"root\"\nvariable. This would be much simpler using xstrfmt.  But\nsince we store the length, too, we can just use a strbuf,\nwhich handles that for us.\n\nNote that we stop distinguishing between \"no root\" and\n\"empty root\" in some cases, but that's OK; the results are\nthe same (e.g., inserting an empty string is a noop).\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/6c31c22cebe9f0b117fd93ee7792d88e82aaa61e"},{"sha":"bd22d4ffbc10052fef1a6c52aec066ee64236340","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"transport: use strbufs for status table \"quickref\" strings\n\nWe generate range strings like \"1234abcd...5678efab\" for use\nin the the fetch and push status tables. We use fixed-size\nbuffers along with strcat to do so. These aren't buggy, as\nour manual size computation is correct, but there's nothing\nchecking that this is so.  Let's switch them to strbufs\ninstead, which are obviously correct, and make it easier to\naudit the code base for problematic calls to strcat().\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/bd22d4ffbc10052fef1a6c52aec066ee64236340"},{"sha":"b4600fbe071898068ef30be2766ee75880ec308b","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"merge-recursive: convert malloc / strcpy to strbuf\n\nThis would be a fairly routine use of xstrfmt, except that\nwe need to remember the length of the result to pass to\ncache_name_pos. So just use a strbuf, which makes this\nsimple.\n\nAs a bonus, this gets rid of confusing references to\n\"pathlen+1\". The \"1\" is for the trailing slash we added, but\nthat is automatically accounted for in the strbuf's len\nparameter.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/b4600fbe071898068ef30be2766ee75880ec308b"},{"sha":"e9ba678175da28607d57043e1363c6252880dd7f","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"enter_repo: convert fixed-size buffers to strbufs\n\nWe use two PATH_MAX-sized buffers to represent the repo\npath, and must make sure not to overflow them. We do take\ncare to check the lengths, but the logic is rather hard to\nfollow, as we use several magic numbers (e.g., \"PATH_MAX -\n10\"). And in fact you _can_ overflow the buffer if you have\na \".git\" file with an extremely long path in it.\n\nBy switching to strbufs, these problems all go away. We do,\nhowever, retain the check that the initial input we get is\nno larger than PATH_MAX. This function is an entry point for\nuntrusted repo names from the network, and it's a good idea\nto keep a sanity check (both to avoid allocating arbitrary\namounts of memory, and also as a layer of defense against\nany downstream users of the names).\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/e9ba678175da28607d57043e1363c6252880dd7f"},{"sha":"4635768809885bb1c063bc9f9eee38e413f85f0d","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"remove_leading_path: use a strbuf for internal storage\n\nThis function strcpy's directly into a PATH_MAX-sized\nbuffer. There's only one caller, which feeds the git_dir into\nit, so it's not easy to trigger in practice (even if you fed\na large $GIT_DIR through the environment or .git file, it\nwould have to actually exist and be accessible on the\nfilesystem to get to this point). We can fix it by moving to\na strbuf.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/4635768809885bb1c063bc9f9eee38e413f85f0d"},{"sha":"d4b3d11a03c5733a37656ca2f23171be6efad7d3","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"write_loose_object: convert to strbuf\n\nWhen creating a loose object tempfile, we use a fixed\nPATH_MAX-sized buffer, and strcpy directly into it. This\nisn't buggy, because we do a rough check of the size, but\nthere's no verification that our guesstimate of the required\nspace is enough (in fact, it's several bytes too big for the\ncurrent naming scheme).\n\nLet's switch to a strbuf, which makes this much easier to\nverify. The allocation overhead should be negligible, since\nwe are replacing a static buffer with a static strbuf, and\nwe'll only need to allocate on the first call.\n\nWhile we're here, we can also document a subtle interaction\nwith mkstemp that would be easy to overlook.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/d4b3d11a03c5733a37656ca2f23171be6efad7d3"},{"sha":"43bb66ae0b2f1e379b73e3f0f697ca0d93e2a57b","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"diagnose_invalid_index_path: use strbuf to avoid strcpy/strcat\n\nWe dynamically allocate a buffer and then strcpy and strcat\ninto it. This isn't buggy, but we'd prefer to avoid these\nsuspicious functions.\n\nThis would be a good candidate for converstion to xstrfmt,\nbut we need to record the length for dealing with index\nentries. A strbuf handles that for us.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/43bb66ae0b2f1e379b73e3f0f697ca0d93e2a57b"},{"sha":"984a43b902f005520e27268fecd10b9b517c0b17","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"fetch-pack: use argv_array for index-pack / unpack-objects\n\nThis cleans up a magic number that must be kept in sync with\nthe rest of the code (the number of argv slots). It also\nlets us drop some fixed buffers and an sprintf (since we\ncan now use argv_array_pushf).\n\nWe do still have to keep one fixed buffer for calling\ngethostname, but at least now the size computations for it\nare much simpler.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/984a43b902f005520e27268fecd10b9b517c0b17"},{"sha":"a0355f6bcde6fb62d9629927b2e241353b38aeef","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"http-push: use an argv_array for setup_revisions\n\nThis drops the magic number for the fixed-size argv arrays,\nso we do not have to wonder if we are overflowing it. We can\nalso drop some confusing sha1_to_hex memory allocation\n(which seems to predate the ring of buffers allowing\nmultiple calls), and get rid of an unchecked sprintf call.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/a0355f6bcde6fb62d9629927b2e241353b38aeef"},{"sha":"0b282cc4b2ceaf2f7f3376f0303f63e9d02fdc91","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"stat_tracking_info: convert to argv_array\n\nIn addition to dropping the magic number for the fixed-size\nargv, we can also drop a fixed-length buffer and some\nstrcpy's into it.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/0b282cc4b2ceaf2f7f3376f0303f63e9d02fdc91"},{"sha":"f063d38b808e184675e5b0931ea0167a013b3fcb","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"daemon: use cld->env_array when re-spawning\n\nThis avoids an ugly strcat into a fixed-size buffer. It's\nnot wrong (the buffer is plenty large enough for an IPv6\naddress plus some minor formatting), but it takes some\neffort to verify that.\n\nUnfortunately we are still stuck with some fixed-size\nbuffers to hold the output of inet_ntop. But at least we now\npass very easy-to-verify parameters, rather than doing a\nmanual computation to account for other data in the buffer.\n\nAs a side effect, this also fixes the case where we might\npass an uninitialized portbuf buffer through the\nenvironment. This probably couldn't happen in practice, as\nit would mean that addr->sa_family was neither AF_INET nor\nAF_INET6 (and that is all we are listening on).\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/f063d38b808e184675e5b0931ea0167a013b3fcb"},{"sha":"d59f765ac9b3d6fc2e6bea262222b80493055f12","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"use sha1_to_hex_r() instead of strcpy\n\nBefore sha1_to_hex_r() existed, a simple way to get hex\nsha1 into a buffer was with:\n\n  strcpy(buf, sha1_to_hex(sha1));\n\nThis isn't wrong (assuming the buf is 41 characters), but it\nmakes auditing the code base for bad strcpy() calls harder,\nas these become false positives.\n\nLet's convert them to sha1_to_hex_r(), and likewise for\nsome calls to find_unique_abbrev(). While we're here, we'll\ndouble-check that all of the buffers are correctly sized,\nand use the more obvious GIT_SHA1_HEXSZ constant.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/d59f765ac9b3d6fc2e6bea262222b80493055f12"},{"sha":"2b87d3a89633fb6078203a77d2610175f94cef95","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"drop strcpy in favor of raw sha1_to_hex\n\nIn some cases where we strcpy() the result of sha1_to_hex(),\nthere's no need; the result goes directly into a printf\nstatement, and we can simply pass the return value from\nsha1_to_hex() directly.\n\nWhen this code was originally written, sha1_to_hex used a\nsingle buffer, and it was not safe to use it twice within a\nsingle expression. That changed as of dcb3450 (sha1_to_hex()\nusage cleanup, 2006-05-03), but this code was never updated.\n\nHistory-dug-by: Eric Sunshine <sunshine@sunshineco.com>\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/2b87d3a89633fb6078203a77d2610175f94cef95"},{"sha":"cbc8feeaf97db39ff7220c4d1b03e0c3fdd2401c","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"color: add overflow checks for parsing colors\n\nOur color parsing is designed to never exceed COLOR_MAXLEN\nbytes. But the relationship between that hand-computed\nnumber and the parsing code is not at all obvious, and we\nmerely hope that it has been computed correctly for all\ncases.\n\nLet's mark the expected \"end\" pointer for the destination\nbuffer and make sure that we do not exceed it.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/cbc8feeaf97db39ff7220c4d1b03e0c3fdd2401c"},{"sha":"6f687c21c07bfb83a63049640cba5fb82c174198","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"use alloc_ref rather than hand-allocating \"struct ref\"\n\nThis saves us some manual computation, and eliminates a call\nto strcpy.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/6f687c21c07bfb83a63049640cba5fb82c174198"},{"sha":"c7ab0ba3405dc6bc8ade1296ef070a5a89660e76","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"avoid sprintf and strcpy with flex arrays\n\nWhen we are allocating a struct with a FLEX_ARRAY member, we\ngenerally compute the size of the array and then sprintf or\nstrcpy into it. Normally we could improve a dynamic allocation\nlike this by using xstrfmt, but it doesn't work here; we\nhave to account for the size of the rest of the struct.\n\nBut we can improve things a bit by storing the length that\nwe use for the allocation, and then feeding it to xsnprintf\nor memcpy, which makes it more obvious that we are not\nwriting more than the allocated number of bytes.\n\nIt would be nice if we had some kind of helper for\nallocating generic flex arrays, but it doesn't work that\nwell:\n\n - the call signature is a little bit unwieldy:\n\n      d = flex_struct(sizeof(*d), offsetof(d, path), fmt, ...);\n\n   You need offsetof here instead of just writing to the\n   end of the base size, because we don't know how the\n   struct is packed (partially this is because FLEX_ARRAY\n   might not be zero, though we can account for that; but\n   the size of the struct may actually be rounded up for\n   alignment, and we can't know that).\n\n - some sites do clever things, like over-allocating because\n   they know they will write larger things into the buffer\n   later (e.g., struct packed_git here).\n\nSo we're better off to just write out each allocation (or\nadd type-specific helpers, though many of these are one-off\nallocations anyway).\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/c7ab0ba3405dc6bc8ade1296ef070a5a89660e76"},{"sha":"b26cb7c777f8fcca5ec26cc6a7f9eba85378104f","author":{"email":"696e3fbcf235d40b6ea1ebd61c87cbea79d444e7@peff.net","name":"Jeff King"},"message":"receive-pack: simplify keep_arg computation\n\nTo generate \"--keep=receive-pack $pid on $host\", we write\nprogressively into a single buffer, which requires keeping\ntrack of how much we've written so far. But since the result\nis destined to go into our argv array, we can simply use\nargv_array_pushf.\n\nUnfortunately we still have to have a fixed-size buffer for\nthe gethostname() call, but at least it now doesn't involve\nany extra size computation. And as a bonus, we drop an\nsprintf and a strcpy call.\n\nSigned-off-by: Jeff King <peff@peff.net>\nSigned-off-by: Junio C Hamano <gitster@pobox.com>","distinct":false,"url":"https://api.github.com/repos/gitster/git/commits/b26cb7c777f8fcca5ec26cc6a7f9eba85378104f"}]}