rugged 1.1.0 → 1.2.0

data/vendor/libgit2/src/pack.h

@@ -20,6 +20,14 @@
 #include "oidmap.h"
 #include "zstream.h"
 
+/**
+ * Function type for callbacks from git_pack_foreach_entry_offset.
+ */
+typedef int git_pack_foreach_entry_offset_cb(
+		const git_oid *id,
+		off64_t offset,
+		void *payload);
+
 #define GIT_PACK_FILE_MODE 0444
 
 #define PACK_SIGNATURE 0x5041434b	/* "PACK" */
@@ -58,7 +66,7 @@ struct git_pack_idx_header {
 
 typedef struct git_pack_cache_entry {
 	size_t last_usage; /* enough? */
-	git_atomic refcount;
+	git_atomic32 refcount;
 	git_rawobj raw;
 } git_pack_cache_entry;
 
@@ -85,8 +93,8 @@ typedef struct {
 struct git_pack_file {
 	git_mwindow_file mwf;
 	git_map index_map;
-	git_mutex lock; /* protect updates to mwf and index_map */
-	git_atomic refcount;
+	git_mutex lock; /* protect updates to index_map */
+	git_atomic32 refcount;
 
 	uint32_t num_objects;
 	uint32_t num_bad_objects;
@@ -133,14 +141,14 @@ typedef struct git_packfile_stream {
 	git_mwindow *mw;
 } git_packfile_stream;
 
-size_t git_packfile__object_header(unsigned char *hdr, size_t size, git_object_t type);
+int git_packfile__object_header(size_t *out, unsigned char *hdr, size_t size, git_object_t type);
 
 int git_packfile__name(char **out, const char *path);
 
 int git_packfile_unpack_header(
 		size_t *size_p,
 		git_object_t *type_p,
-		git_mwindow_file *mwf,
+		struct git_pack_file *p,
 		git_mwindow **w_curs,
 		off64_t *curpos);
 
@@ -164,8 +172,7 @@ int get_delta_base(
 		git_object_t type,
 		off64_t delta_obj_offset);
 
-void git_packfile_close(struct git_pack_file *p, bool unlink_packfile);
-void git_packfile_free(struct git_pack_file *p);
+void git_packfile_free(struct git_pack_file *p, bool unlink_packfile);
 int git_packfile_alloc(struct git_pack_file **pack_out, const char *path);
 
 int git_pack_entry_find(
@@ -177,5 +184,16 @@ int git_pack_foreach_entry(
 		struct git_pack_file *p,
 		git_odb_foreach_cb cb,
 		void *data);
+/**
+ * Similar to git_pack_foreach_entry, but:
+ * - It also provides the offset of the object within the
+ *   packfile.
+ * - It does not sort the objects in any order.
+ * - It retains the lock while invoking the callback.
+ */
+int git_pack_foreach_entry_offset(
+		struct git_pack_file *p,
+		git_pack_foreach_entry_offset_cb cb,
+		void *data);
 
 #endif

data/vendor/libgit2/src/patch.c

@@ -65,7 +65,7 @@ size_t git_patch_size(
 {
 	size_t out;
 
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	out = patch->content_size;
 
@@ -129,13 +129,13 @@ int git_patch_line_stats(
 
 const git_diff_delta *git_patch_get_delta(const git_patch *patch)
 {
-	assert(patch);
+	GIT_ASSERT_ARG_WITH_RETVAL(patch, NULL);
 	return patch->delta;
 }
 
 size_t git_patch_num_hunks(const git_patch *patch)
 {
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 	return git_array_size(patch->hunks);
 }
 
@@ -152,7 +152,7 @@ int git_patch_get_hunk(
 	size_t hunk_idx)
 {
 	git_patch_hunk *hunk;
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	hunk = git_array_get(patch->hunks, hunk_idx);
 
@@ -170,7 +170,7 @@ int git_patch_get_hunk(
 int git_patch_num_lines_in_hunk(const git_patch *patch, size_t hunk_idx)
 {
 	git_patch_hunk *hunk;
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	if (!(hunk = git_array_get(patch->hunks, hunk_idx)))
 		return patch_error_outofrange("hunk");
@@ -186,7 +186,7 @@ int git_patch_get_line_in_hunk(
 	git_patch_hunk *hunk;
 	git_diff_line *line;
 
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	if (!(hunk = git_array_get(patch->hunks, hunk_idx))) {
 		if (out) *out = NULL;
@@ -204,9 +204,16 @@ int git_patch_get_line_in_hunk(
 	return 0;
 }
 
+git_repository *git_patch_owner(const git_patch *patch)
+{
+	return patch->repo;
+}
+
 int git_patch_from_diff(git_patch **out, git_diff *diff, size_t idx)
 {
-	assert(out && diff && diff->patch_fn);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diff);
+	GIT_ASSERT_ARG(diff->patch_fn);
 	return diff->patch_fn(out, diff, idx);
 }
 

data/vendor/libgit2/src/patch_generate.c

@@ -561,7 +561,7 @@ static int patch_from_sources(
 	patch_generated_with_delta *pd;
 	git_xdiff_output xo;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 	*out = NULL;
 
 	if ((error = patch_generated_with_delta_alloc(
@@ -840,7 +840,7 @@ static int patch_generated_line_cb(
 	GIT_UNUSED(hunk_);
 
 	hunk = git_array_last(patch->base.hunks);
-	assert(hunk); /* programmer error if no hunk is available */
+	GIT_ASSERT(hunk); /* programmer error if no hunk is available */
 
 	line = git_array_alloc(patch->base.lines);
 	GIT_ERROR_CHECK_ALLOC(line);

data/vendor/libgit2/src/patch_parse.c

@@ -1168,7 +1168,8 @@ int git_patch_parse(
 	size_t start, used;
 	int error = 0;
 
-	assert(out && ctx);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ctx);
 
 	*out = NULL;
 

data/vendor/libgit2/src/path.c

@@ -274,24 +274,6 @@ size_t git_path_basename_offset(git_buf *buffer)
 	return 0;
 }
 
-const char *git_path_topdir(const char *path)
-{
-	size_t len;
-	ssize_t i;
-
-	assert(path);
-	len = strlen(path);
-
-	if (!len || path[len - 1] != '/')
-		return NULL;
-
-	for (i = (ssize_t)len - 2; i >= 0; --i)
-		if (path[i] == '/')
-			break;
-
-	return &path[i + 1];
-}
-
 int git_path_root(const char *path)
 {
 	int offset = 0, prefix_len;
@@ -325,7 +307,9 @@ int git_path_root(const char *path)
 static void path_trim_slashes(git_buf *path)
 {
 	int ceiling = git_path_root(path->ptr) + 1;
-	assert(ceiling >= 0);
+
+	if (ceiling < 0)
+		return;
 
 	while (path->size > (size_t)ceiling) {
 		if (path->ptr[path->size-1] != '/')
@@ -341,7 +325,8 @@ int git_path_join_unrooted(
 {
 	ssize_t root;
 
-	assert(path && path_out);
+	GIT_ASSERT_ARG(path_out);
+	GIT_ASSERT_ARG(path);
 
 	root = (ssize_t)git_path_root(path);
 
@@ -389,7 +374,8 @@ int git_path_prettify(git_buf *path_out, const char *path, const char *base)
 {
 	char buf[GIT_PATH_MAX];
 
-	assert(path && path_out);
+	GIT_ASSERT_ARG(path_out);
+	GIT_ASSERT_ARG(path);
 
 	/* construct path if needed */
 	if (base != NULL && git_path_root(path) < 0) {
@@ -440,7 +426,9 @@ void git_path_string_to_dir(char* path, size_t size)
 int git__percent_decode(git_buf *decoded_out, const char *input)
 {
 	int len, hi, lo, i;
-	assert(decoded_out && input);
+
+	GIT_ASSERT_ARG(decoded_out);
+	GIT_ASSERT_ARG(input);
 
 	len = (int)strlen(input);
 	git_buf_clear(decoded_out);
@@ -501,7 +489,8 @@ int git_path_fromurl(git_buf *local_path_out, const char *file_url)
 {
 	int offset;
 
-	assert(local_path_out && file_url);
+	GIT_ASSERT_ARG(local_path_out);
+	GIT_ASSERT_ARG(file_url);
 
 	if ((offset = local_file_url_prefixlen(file_url)) < 0 ||
 		file_url[offset] == '\0' || file_url[offset] == '/')
@@ -526,7 +515,8 @@ int git_path_walk_up(
 	ssize_t stop = 0, scan;
 	char oldc = '\0';
 
-	assert(path && cb);
+	GIT_ASSERT_ARG(path);
+	GIT_ASSERT_ARG(cb);
 
 	if (ceiling != NULL) {
 		if (git__prefixcmp(path->ptr, ceiling) == 0)
@@ -581,7 +571,7 @@ int git_path_walk_up(
 
 bool git_path_exists(const char *path)
 {
-	assert(path);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, false);
 	return p_access(path, F_OK) == 0;
 }
 
@@ -598,7 +588,7 @@ bool git_path_isfile(const char *path)
 {
 	struct stat st;
 
-	assert(path);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, false);
 	if (p_stat(path, &st) < 0)
 		return false;
 
@@ -609,7 +599,7 @@ bool git_path_islink(const char *path)
 {
 	struct stat st;
 
-	assert(path);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, false);
 	if (p_lstat(path, &st) < 0)
 		return false;
 
@@ -764,15 +754,13 @@ bool git_path_contains_file(git_buf *base, const char *file)
 	return _check_dir_contents(base, file, &git_path_isfile);
 }
 
-int git_path_find_dir(git_buf *dir, const char *path, const char *base)
+int git_path_find_dir(git_buf *dir)
 {
-	int error = git_path_join_unrooted(dir, path, base, NULL);
+	int error = 0;
+	char buf[GIT_PATH_MAX];
 
-	if (!error) {
-		char buf[GIT_PATH_MAX];
-		if (p_realpath(dir->ptr, buf) != NULL)
-			error = git_buf_sets(dir, buf);
-	}
+	if (p_realpath(dir->ptr, buf) != NULL)
+		error = git_buf_sets(dir, buf);
 
 	/* call dirname if this is not a directory */
 	if (!error) /* && git_path_isdir(dir->ptr) == false) */
@@ -1211,7 +1199,8 @@ int git_path_diriter_init(
 	if (is_win7_or_later < 0)
 		is_win7_or_later = git_has_win32_version(6, 1, 0);
 
-	assert(diriter && path);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT_ARG(path);
 
 	memset(diriter, 0, sizeof(git_path_diriter));
 	diriter->handle = INVALID_HANDLE_VALUE;
@@ -1311,9 +1300,10 @@ int git_path_diriter_filename(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
-
-	assert(diriter->path_utf8.size > diriter->parent_utf8_len);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT(diriter->path_utf8.size > diriter->parent_utf8_len);
 
 	*out = &diriter->path_utf8.ptr[diriter->parent_utf8_len+1];
 	*out_len = diriter->path_utf8.size - diriter->parent_utf8_len - 1;
@@ -1325,7 +1315,9 @@ int git_path_diriter_fullpath(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
 
 	*out = diriter->path_utf8.ptr;
 	*out_len = diriter->path_utf8.size;
@@ -1334,7 +1326,8 @@ int git_path_diriter_fullpath(
 
 int git_path_diriter_stat(struct stat *out, git_path_diriter *diriter)
 {
-	assert(out && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diriter);
 
 	return git_win32__file_attribute_to_stat(out,
 		(WIN32_FILE_ATTRIBUTE_DATA *)&diriter->current,
@@ -1361,7 +1354,8 @@ int git_path_diriter_init(
 	const char *path,
 	unsigned int flags)
 {
-	assert(diriter && path);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT_ARG(path);
 
 	memset(diriter, 0, sizeof(git_path_diriter));
 
@@ -1401,7 +1395,7 @@ int git_path_diriter_next(git_path_diriter *diriter)
 	bool skip_dot = !(diriter->flags & GIT_PATH_DIR_INCLUDE_DOT_AND_DOTDOT);
 	int error = 0;
 
-	assert(diriter);
+	GIT_ASSERT_ARG(diriter);
 
 	errno = 0;
 
@@ -1444,9 +1438,10 @@ int git_path_diriter_filename(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
-
-	assert(diriter->path.size > diriter->parent_len);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT(diriter->path.size > diriter->parent_len);
 
 	*out = &diriter->path.ptr[diriter->parent_len+1];
 	*out_len = diriter->path.size - diriter->parent_len - 1;
@@ -1458,7 +1453,9 @@ int git_path_diriter_fullpath(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
 
 	*out = diriter->path.ptr;
 	*out_len = diriter->path.size;
@@ -1467,7 +1464,8 @@ int git_path_diriter_fullpath(
 
 int git_path_diriter_stat(struct stat *out, git_path_diriter *diriter)
 {
-	assert(out && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diriter);
 
 	return git_path_lstat(diriter->path.ptr, out);
 }
@@ -1503,7 +1501,8 @@ int git_path_dirload(
 	char *dup;
 	int error;
 
-	assert(contents && path);
+	GIT_ASSERT_ARG(contents);
+	GIT_ASSERT_ARG(path);
 
 	if ((error = git_path_diriter_init(&iter, path, flags)) < 0)
 		return error;
@@ -1512,7 +1511,7 @@ int git_path_dirload(
 		if ((error = git_path_diriter_fullpath(&name, &name_len, &iter)) < 0)
 			break;
 
-		assert(name_len > prefix_len);
+		GIT_ASSERT(name_len > prefix_len);
 
 		dup = git__strndup(name + prefix_len, name_len - prefix_len);
 		GIT_ERROR_CHECK_ALLOC(dup);
@@ -1561,8 +1560,8 @@ GIT_INLINE(bool) verify_dospath(
 static int32_t next_hfs_char(const char **in, size_t *len)
 {
 	while (*len) {
-		int32_t codepoint;
-		int cp_len = git__utf8_iterate((const uint8_t *)(*in), (int)(*len), &codepoint);
+		uint32_t codepoint;
+		int cp_len = git_utf8_iterate(&codepoint, *in, *len);
 		if (cp_len < 0)
 			return -1;
 
@@ -1594,7 +1593,7 @@ static int32_t next_hfs_char(const char **in, size_t *len)
 		 * the ASCII range, which is perfectly fine, because the
 		 * git folder name can only be composed of ascii characters
 		 */
-		return git__tolower(codepoint);
+		return git__tolower((int)codepoint);
 	}
 	return 0; /* NULL byte -- end of string */
 }
@@ -1876,7 +1875,7 @@ GIT_INLINE(unsigned int) dotgit_flags(
 	return flags;
 }
 
-bool git_path_isvalid(
+bool git_path_validate(
 	git_repository *repo,
 	const char *path,
 	uint16_t mode,
@@ -1903,6 +1902,52 @@ bool git_path_isvalid(
 	return verify_component(repo, start, (c - start), mode, flags);
 }
 
+#ifdef GIT_WIN32
+GIT_INLINE(bool) should_validate_longpaths(git_repository *repo)
+{
+	int longpaths = 0;
+
+	if (repo &&
+	    git_repository__configmap_lookup(&longpaths, repo, GIT_CONFIGMAP_LONGPATHS) < 0)
+		longpaths = 0;
+
+	return (longpaths == 0);
+}
+
+#else
+
+GIT_INLINE(bool) should_validate_longpaths(git_repository *repo)
+{
+	GIT_UNUSED(repo);
+
+	return false;
+}
+#endif
+
+int git_path_validate_workdir(git_repository *repo, const char *path)
+{
+	if (should_validate_longpaths(repo))
+		return git_path_validate_filesystem(path, strlen(path));
+
+	return 0;
+}
+
+int git_path_validate_workdir_with_len(
+	git_repository *repo,
+	const char *path,
+	size_t path_len)
+{
+	if (should_validate_longpaths(repo))
+		return git_path_validate_filesystem(path, path_len);
+
+	return 0;
+}
+
+int git_path_validate_workdir_buf(git_repository *repo, git_buf *path)
+{
+	return git_path_validate_workdir_with_len(repo, path->ptr, path->size);
+}
+
 int git_path_normalize_slashes(git_buf *out, const char *path)
 {
 	int error;

data/vendor/libgit2/src/path.h

@@ -67,8 +67,6 @@ extern int git_path_basename_r(git_buf *buffer, const char *path);
  */
 extern size_t git_path_basename_offset(git_buf *buffer);
 
-extern const char *git_path_topdir(const char *path);
-
 /**
  * Find offset to root of path if path has one.
  *
@@ -285,7 +283,7 @@ extern int git_path_prettify_dir(git_buf *path_out, const char *path, const char
  * appends the trailing '/'.  If the path does not exist, it is
  * treated like a regular filename.
  */
-extern int git_path_find_dir(git_buf *dir, const char *path, const char *base);
+extern int git_path_find_dir(git_buf *dir);
 
 /**
  * Resolve relative references within a path.
@@ -628,20 +626,95 @@ extern int git_path_from_url_or_path(git_buf *local_path_out, const char *url_or
 #define GIT_PATH_REJECT_INDEX_DEFAULTS \
 	GIT_PATH_REJECT_TRAVERSAL | GIT_PATH_REJECT_DOT_GIT
 
-/*
- * Determine whether a path is a valid git path or not - this must not contain
+/**
+ * Validate a "bare" git path.  This ensures that the given path is legal
+ * to place in the index or a tree.  This should be checked by mechanisms
+ * like `git_index_add` and `git_treebuilder_insert` when taking user
+ * data, and by `git_checkout` before constructing on-disk paths.
+ *
+ * This will ensure that a git path does not contain any "unsafe" components,
  * a '.' or '..' component, or a component that is ".git" (in any case).
  *
+ * (Note: if you take or construct an on-disk path -- a workdir path,
+ * a path to a git repository or a reference name that could be a loose
+ * ref -- you should _also_ validate that with `git_path_validate_workdir`.)
+ *
  * `repo` is optional.  If specified, it will be used to determine the short
  * path name to reject (if `GIT_PATH_REJECT_DOS_SHORTNAME` is specified),
  * in addition to the default of "git~1".
  */
-extern bool git_path_isvalid(
+extern bool git_path_validate(
 	git_repository *repo,
 	const char *path,
 	uint16_t mode,
 	unsigned int flags);
 
+/**
+ * Validate an on-disk path, taking into account that it will have a
+ * suffix appended (eg, `.lock`).
+ */
+GIT_INLINE(int) git_path_validate_filesystem_with_suffix(
+	const char *path,
+	size_t path_len,
+	size_t suffix_len)
+{
+#ifdef GIT_WIN32
+	size_t path_chars, total_chars;
+
+	path_chars = git_utf8_char_length(path, path_len);
+
+	if (GIT_ADD_SIZET_OVERFLOW(&total_chars, path_chars, suffix_len) ||
+	    total_chars > MAX_PATH) {
+		git_error_set(GIT_ERROR_FILESYSTEM, "path too long: '%s'", path);
+		return -1;
+	}
+	return 0;
+#else
+	GIT_UNUSED(path);
+	GIT_UNUSED(path_len);
+	GIT_UNUSED(suffix_len);
+	return 0;
+#endif
+}
+
+/**
+ * Validate an path on the filesystem.  This ensures that the given
+ * path is valid for the operating system/platform; for example, this
+ * will ensure that the given absolute path is smaller than MAX_PATH on
+ * Windows.
+ *
+ * For paths within the working directory, you should use ensure that
+ * `core.longpaths` is obeyed.  Use `git_path_validate_workdir`.
+ */
+GIT_INLINE(int) git_path_validate_filesystem(
+	const char *path,
+	size_t path_len)
+{
+	return git_path_validate_filesystem_with_suffix(path, path_len, 0);
+}
+
+/**
+ * Validate a path relative to the repo's worktree.  This ensures that
+ * the given working tree path is valid for the operating system/platform.
+ * This will ensure that an absolute path is smaller than MAX_PATH on
+ * Windows, while keeping `core.longpaths` configuration settings in mind.
+ *
+ * This should be checked by mechamisms like `git_checkout` after
+ * contructing on-disk paths and before trying to write them.
+ *
+ * If the repository is null, no repository configuration is applied.
+ */
+extern int git_path_validate_workdir(
+	git_repository *repo,
+	const char *path);
+extern int git_path_validate_workdir_with_len(
+	git_repository *repo,
+	const char *path,
+	size_t path_len);
+extern int git_path_validate_workdir_buf(
+	git_repository *repo,
+	git_buf *buf);
+
 /**
  * Convert any backslashes into slashes
  */

data/vendor/libgit2/src/pathspec.c

@@ -9,7 +9,6 @@
 
 #include "git2/pathspec.h"
 #include "git2/diff.h"
-#include "buf_text.h"
 #include "attr_file.h"
 #include "iterator.h"
 #include "repository.h"
@@ -25,7 +24,7 @@ char *git_pathspec_prefix(const git_strarray *pathspec)
 	const char *scan;
 
 	if (!pathspec || !pathspec->count ||
-		git_buf_text_common_prefix(&prefix, pathspec) < 0)
+		git_buf_common_prefix(&prefix, pathspec) < 0)
 		return NULL;
 
 	/* diff prefix will only be leading non-wildcards */
@@ -41,7 +40,7 @@ char *git_pathspec_prefix(const git_strarray *pathspec)
 		return NULL;
 	}
 
-	git_buf_text_unescape(&prefix);
+	git_buf_unescape(&prefix);
 
 	return git_buf_detach(&prefix);
 }
@@ -289,7 +288,8 @@ int git_pathspec_matches_path(
 	bool no_fnmatch = (flags & GIT_PATHSPEC_NO_GLOB) != 0;
 	bool casefold =  (flags & GIT_PATHSPEC_IGNORE_CASE) != 0;
 
-	assert(ps && path);
+	GIT_ASSERT_ARG(ps);
+	GIT_ASSERT_ARG(path);
 
 	return (0 != git_pathspec__match(
 		&ps->pathspec, path, no_fnmatch, casefold, NULL, NULL));
@@ -526,7 +526,7 @@ int git_pathspec_match_workdir(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -548,7 +548,7 @@ int git_pathspec_match_index(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -570,7 +570,7 @@ int git_pathspec_match_tree(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(tree);
+	GIT_ASSERT_ARG(tree);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -598,7 +598,7 @@ int git_pathspec_match_diff(
 	const git_diff_delta *delta, **match;
 	git_bitvec used_patterns;
 
-	assert(diff);
+	GIT_ASSERT_ARG(diff);
 
 	if (git_bitvec_init(&used_patterns, patterns->length) < 0)
 		return -1;