rugged 1.1.1 → 1.2.0

data/vendor/libgit2/src/index.h

@@ -33,7 +33,7 @@ struct git_index {
 	git_idxmap *entries_map;
 
 	git_vector deleted; /* deleted entries if readers > 0 */
-	git_atomic readers; /* number of active iterators */
+	git_atomic32 readers; /* number of active iterators */
 
 	unsigned int on_disk:1;
 	unsigned int ignore_case:1;

data/vendor/libgit2/src/indexer.c

@@ -24,8 +24,6 @@
 #include "zstream.h"
 #include "object.h"
 
-extern git_mutex git__mwindow_mutex;
-
 size_t git_indexer__max_objects = UINT32_MAX;
 
 #define UINT31_MAX (0x7FFFFFFF)
@@ -239,7 +237,8 @@ static int hash_object_stream(git_indexer*idx, git_packfile_stream *stream)
 {
 	ssize_t read;
 
-	assert(idx && stream);
+	GIT_ASSERT_ARG(idx);
+	GIT_ASSERT_ARG(stream);
 
 	do {
 		if ((read = git_packfile_stream_read(stream, idx->objbuf, sizeof(idx->objbuf))) < 0)
@@ -262,7 +261,7 @@ static int advance_delta_offset(git_indexer *idx, git_object_t type)
 {
 	git_mwindow *w = NULL;
 
-	assert(type == GIT_OBJECT_REF_DELTA || type == GIT_OBJECT_OFS_DELTA);
+	GIT_ASSERT_ARG(type == GIT_OBJECT_REF_DELTA || type == GIT_OBJECT_OFS_DELTA);
 
 	if (type == GIT_OBJECT_REF_DELTA) {
 		idx->off += GIT_OID_RAWSZ;
@@ -282,7 +281,7 @@ static int read_object_stream(git_indexer *idx, git_packfile_stream *stream)
 {
 	ssize_t read;
 
-	assert(stream);
+	GIT_ASSERT_ARG(stream);
 
 	do {
 		read = git_packfile_stream_read(stream, idx->objbuf, sizeof(idx->objbuf));
@@ -629,7 +628,8 @@ static int write_at(git_indexer *idx, const void *data, off64_t offset, size_t s
 	git_map map;
 	int error;
 
-	assert(data && size);
+	GIT_ASSERT_ARG(data);
+	GIT_ASSERT_ARG(size);
 
 	if ((error = git__mmap_alignment(&mmap_alignment)) < 0)
 		return error;
@@ -693,7 +693,7 @@ static int read_stream_object(git_indexer *idx, git_indexer_progress *stats)
 		return GIT_EBUFS;
 
 	if (!idx->have_stream) {
-		error = git_packfile_unpack_header(&entry_size, &type, &idx->pack->mwf, &w, &idx->off);
+		error = git_packfile_unpack_header(&entry_size, &type, idx->pack, &w, &idx->off);
 		if (error == GIT_EBUFS) {
 			idx->off = entry_start;
 			return error;
@@ -775,7 +775,9 @@ int git_indexer_append(git_indexer *idx, const void *data, size_t size, git_inde
 	struct git_pack_header *hdr = &idx->hdr;
 	git_mwindow_file *mwf = &idx->pack->mwf;
 
-	assert(idx && data && stats);
+	GIT_ASSERT_ARG(idx);
+	GIT_ASSERT_ARG(data);
+	GIT_ASSERT_ARG(stats);
 
 	if ((error = append_to_pack(idx, data, size)) < 0)
 		return error;
@@ -829,7 +831,8 @@ int git_indexer_append(git_indexer *idx, const void *data, size_t size, git_inde
 	/* Now that we have data in the pack, let's try to parse it */
 
 	/* As the file grows any windows we try to use will be out of date */
-	git_mwindow_free_all(mwf);
+	if ((error = git_mwindow_free_all(mwf)) < 0)
+		goto on_error;
 
 	while (stats->indexed_objects < idx->nr_objects) {
 		if ((error = read_stream_object(idx, stats)) != 0) {
@@ -873,16 +876,16 @@ static int index_path(git_buf *path, git_indexer *idx, const char *suffix)
  * Rewind the packfile by the trailer, as we might need to fix the
  * packfile by injecting objects at the tail and must overwrite it.
  */
-static void seek_back_trailer(git_indexer *idx)
+static int seek_back_trailer(git_indexer *idx)
 {
 	idx->pack->mwf.size -= GIT_OID_RAWSZ;
-	git_mwindow_free_all(&idx->pack->mwf);
+	return git_mwindow_free_all(&idx->pack->mwf);
 }
 
 static int inject_object(git_indexer *idx, git_oid *id)
 {
-	git_odb_object *obj;
-	struct entry *entry;
+	git_odb_object *obj = NULL;
+	struct entry *entry = NULL;
 	struct git_pack_entry *pentry = NULL;
 	git_oid foo = {{0}};
 	unsigned char hdr[64];
@@ -892,12 +895,14 @@ static int inject_object(git_indexer *idx, git_oid *id)
 	size_t len, hdr_len;
 	int error;
 
-	seek_back_trailer(idx);
+	if ((error = seek_back_trailer(idx)) < 0)
+		goto cleanup;
+
 	entry_start = idx->pack->mwf.size;
 
-	if (git_odb_read(&obj, idx->odb, id) < 0) {
+	if ((error = git_odb_read(&obj, idx->odb, id)) < 0) {
 		git_error_set(GIT_ERROR_INDEXER, "missing delta bases");
-		return -1;
+		goto cleanup;
 	}
 
 	data = git_odb_object_data(obj);
@@ -909,8 +914,8 @@ static int inject_object(git_indexer *idx, git_oid *id)
 	entry->crc = crc32(0L, Z_NULL, 0);
 
 	/* Write out the object header */
-	hdr_len = git_packfile__object_header(hdr, len, git_odb_object_type(obj));
-	if ((error = append_to_pack(idx, hdr, hdr_len)) < 0)
+	if ((error = git_packfile__object_header(&hdr_len, hdr, len, git_odb_object_type(obj))) < 0 ||
+	    (error = append_to_pack(idx, hdr, hdr_len)) < 0)
 		goto cleanup;
 
 	idx->pack->mwf.size += hdr_len;
@@ -966,7 +971,7 @@ static int fix_thin_pack(git_indexer *idx, git_indexer_progress *stats)
 	unsigned int left = 0;
 	git_oid base;
 
-	assert(git_vector_length(&idx->deltas) > 0);
+	GIT_ASSERT(git_vector_length(&idx->deltas) > 0);
 
 	if (idx->odb == NULL) {
 		git_error_set(GIT_ERROR_INDEXER, "cannot fix a thin pack without an ODB");
@@ -979,7 +984,7 @@ static int fix_thin_pack(git_indexer *idx, git_indexer_progress *stats)
 			continue;
 
 		curpos = delta->delta_off;
-		error = git_packfile_unpack_header(&size, &type, &idx->pack->mwf, &w, &curpos);
+		error = git_packfile_unpack_header(&size, &type, idx->pack, &w, &curpos);
 		if (error < 0)
 			return error;
 
@@ -1097,7 +1102,9 @@ static int update_header_and_rehash(git_indexer *idx, git_indexer_progress *stat
 	 * hash_partially() keep the existing trailer out of the
 	 * calculation.
 	 */
-	git_mwindow_free_all(mwf);
+	if (git_mwindow_free_all(mwf) < 0)
+		return -1;
+
 	idx->inbuf_len = 0;
 	while (hashed < mwf->size) {
 		ptr = git_mwindow_open(mwf, &w, hashed, chunk, &left);
@@ -1269,7 +1276,8 @@ int git_indexer_commit(git_indexer *idx, git_indexer_progress *stats)
 	if (git_filebuf_commit_at(&index_file, filename.ptr) < 0)
 		goto on_error;
 
-	git_mwindow_free_all(&idx->pack->mwf);
+	if (git_mwindow_free_all(&idx->pack->mwf) < 0)
+		goto on_error;
 
 	/* Truncate file to undo rounding up to next page_size in append_to_pack */
 	if (p_ftruncate(idx->pack->mwf.fd, idx->pack->mwf.size) < 0) {
@@ -1339,13 +1347,7 @@ void git_indexer_free(git_indexer *idx)
 
 	git_vector_free_deep(&idx->deltas);
 
-	if (!git_mutex_lock(&git__mwindow_mutex)) {
-		if (!idx->pack_committed)
-			git_packfile_close(idx->pack, true);
-
-		git_packfile_free(idx->pack);
-		git_mutex_unlock(&git__mwindow_mutex);
-	}
+	git_packfile_free(idx->pack, !idx->pack_committed);
 
 	iter = 0;
 	while (git_oidmap_iterate((void **) &value, idx->expected_oids, &iter, &key) == 0)

data/vendor/libgit2/src/integer.h

@@ -43,10 +43,10 @@ GIT_INLINE(int) git__is_ulong(int64_t p)
 }
 
 /** @return true if p fits into the range of an int */
-GIT_INLINE(int) git__is_int(long long p)
+GIT_INLINE(int) git__is_int(int64_t p)
 {
 	int r = (int)p;
-	return p == (long long)r;
+	return p == (int64_t)r;
 }
 
 /* Use clang/gcc compiler intrinsics whenever possible */
@@ -80,6 +80,12 @@ GIT_INLINE(int) git__is_int(long long p)
 # define git__add_int64_overflow(out, one, two) \
     __builtin_add_overflow(one, two, out)
 
+/* clang on 32-bit systems produces an undefined reference to `__mulodi4`. */
+# if !defined(__clang__) || !defined(GIT_ARCH_32)
+#  define git__multiply_int64_overflow(out, one, two) \
+     __builtin_mul_overflow(one, two, out)
+# endif
+
 /* Use Microsoft's safe integer handling functions where available */
 #elif defined(_MSC_VER)
 
@@ -90,6 +96,7 @@ GIT_INLINE(int) git__is_int(long long p)
     (SizeTAdd(one, two, out) != S_OK)
 # define git__multiply_sizet_overflow(out, one, two) \
     (SizeTMult(one, two, out) != S_OK)
+
 #define git__add_int_overflow(out, one, two) \
     (IntAdd(one, two, out) != S_OK)
 #define git__sub_int_overflow(out, one, two) \
@@ -97,6 +104,8 @@ GIT_INLINE(int) git__is_int(long long p)
 
 #define git__add_int64_overflow(out, one, two) \
     (LongLongAdd(one, two, out) != S_OK)
+#define git__multiply_int64_overflow(out, one, two) \
+    (LongLongMult(one, two, out) != S_OK)
 
 #else
 
@@ -153,4 +162,57 @@ GIT_INLINE(bool) git__add_int64_overflow(int64_t *out, int64_t one, int64_t two)
 
 #endif
 
+/* If we could not provide an intrinsic implementation for this, provide a (slow) fallback. */
+#if !defined(git__multiply_int64_overflow)
+GIT_INLINE(bool) git__multiply_int64_overflow(int64_t *out, int64_t one, int64_t two)
+{
+	/*
+	 * Detects whether `INT64_MAX < (one * two) || INT64_MIN > (one * two)`,
+	 * without incurring in undefined behavior. That is done by performing the
+	 * comparison with a division instead of a multiplication, which translates
+	 * to `INT64_MAX / one < two || INT64_MIN / one > two`. Some caveats:
+	 *
+	 * - The comparison sign is inverted when both sides of the inequality are
+	 *   multiplied/divided by a negative number, so if `one < 0` the comparison
+	 *   needs to be flipped.
+	 * - `INT64_MAX / -1` itself overflows (or traps), so that case should be
+	 *   avoided.
+	 * - Since the overflow flag is defined as the discrepance between the result
+	 *   of performing the multiplication in a signed integer at twice the width
+	 *   of the operands, and the truncated+sign-extended version of that same
+	 *   result, there are four cases where the result is the opposite of what
+	 *   would be expected:
+	 *   * `INT64_MIN * -1` / `-1 * INT64_MIN`
+	 *   * `INT64_MIN * 1 / `1 * INT64_MIN`
+	 */
+	if (one && two) {
+		if (one > 0 && two > 0) {
+			if (INT64_MAX / one < two)
+				return true;
+		} else if (one < 0 && two < 0) {
+			if ((one == -1 && two == INT64_MIN) ||
+				  (two == -1 && one == INT64_MIN)) {
+				*out = INT64_MIN;
+				return false;
+			}
+			if (INT64_MAX / one > two)
+				return true;
+		} else if (one > 0 && two < 0) {
+			if ((one == 1 && two == INT64_MIN) ||
+			    (INT64_MIN / one > two))
+				return true;
+		} else if (one == -1) {
+			if (INT64_MIN / two > one)
+				return true;
+		} else {
+			if ((one == INT64_MIN && two == 1) ||
+			    (INT64_MIN / one < two))
+				return true;
+		}
+	}
+	*out = one * two;
+	return false;
+}
+#endif
+
 #endif

data/vendor/libgit2/src/iterator.c

@@ -330,7 +330,7 @@ static iterator_pathlist_search_t iterator_pathlist_search(
 			break;
 
 		/* an exact match would have been matched by the bsearch above */
-		assert(p[path_len]);
+		GIT_ASSERT_WITH_RETVAL(p[path_len], ITERATOR_PATHLIST_NONE);
 
 		/* is this a literal directory entry (eg `foo/`) or a file beneath */
 		if (p[path_len] == '/') {
@@ -678,14 +678,14 @@ done:
 	return error;
 }
 
-static void tree_iterator_frame_pop(tree_iterator *iter)
+static int tree_iterator_frame_pop(tree_iterator *iter)
 {
 	tree_iterator_frame *frame;
 	git_buf *buf = NULL;
 	git_tree *tree;
 	size_t i;
 
-	assert(iter->frames.size);
+	GIT_ASSERT(iter->frames.size);
 
 	frame = git_array_pop(iter->frames);
 
@@ -705,6 +705,8 @@ static void tree_iterator_frame_pop(tree_iterator *iter)
 	git_vector_free(&frame->similar_trees);
 
 	git_buf_dispose(&frame->path);
+
+	return 0;
 }
 
 static int tree_iterator_current(
@@ -760,7 +762,9 @@ static int tree_iterator_advance(const git_index_entry **out, git_iterator *i)
 
 		/* no more entries in this frame.  pop the frame out */
 		if (frame->next_idx == frame->entries.length) {
-			tree_iterator_frame_pop(iter);
+			if ((error = tree_iterator_frame_pop(iter)) < 0)
+				break;
+
 			continue;
 		}
 
@@ -838,7 +842,7 @@ static int tree_iterator_advance_into(
 	const git_index_entry **out, git_iterator *i)
 {
 	tree_iterator *iter = (tree_iterator *)i;
-    tree_iterator_frame *frame;
+	tree_iterator_frame *frame;
 	tree_iterator_entry *prev_entry;
 	int error;
 
@@ -855,7 +859,7 @@ static int tree_iterator_advance_into(
 	 * we will have pushed a new (empty) frame on to the stack for this
 	 * new directory.  since it's empty, its current_entry should be null.
 	 */
-	assert(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
+	GIT_ASSERT(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
 
 	if (prev_entry) {
 		if (!git_tree_entry__is_tree(prev_entry->tree_entry))
@@ -973,7 +977,7 @@ int git_iterator_current_tree_entry(
 	tree_iterator_frame *frame;
 	tree_iterator_entry *entry;
 
-	assert(i->type == GIT_ITERATOR_TREE);
+	GIT_ASSERT(i->type == GIT_ITERATOR_TREE);
 
 	iter = (tree_iterator *)i;
 
@@ -990,11 +994,11 @@ int git_iterator_current_parent_tree(
 	tree_iterator *iter;
 	tree_iterator_frame *frame;
 
-	assert(i->type == GIT_ITERATOR_TREE);
+	GIT_ASSERT(i->type == GIT_ITERATOR_TREE);
 
 	iter = (tree_iterator *)i;
 
-	assert(depth < iter->frames.size);
+	GIT_ASSERT(depth < iter->frames.size);
 	frame = &iter->frames.ptr[iter->frames.size-depth-1];
 
 	*parent_tree = frame->tree;
@@ -1274,7 +1278,8 @@ static int filesystem_iterator_entry_hash(
 		return git_repository_hashfile(&entry->id,
 			iter->base.repo, entry->path, GIT_OBJECT_BLOB, NULL);
 
-	if (!(error = git_buf_joinpath(&fullpath, iter->root, entry->path)))
+	if (!(error = git_buf_joinpath(&fullpath, iter->root, entry->path)) &&
+	    !(error = git_path_validate_workdir_buf(iter->base.repo, &fullpath)))
 		error = git_odb_hashfile(&entry->id, fullpath.ptr, GIT_OBJECT_BLOB);
 
 	git_buf_dispose(&fullpath);
@@ -1355,7 +1360,8 @@ static int filesystem_iterator_frame_push(
 	else
 		git_buf_puts(&root, iter->root);
 
-	if (git_buf_oom(&root)) {
+	if (git_buf_oom(&root) ||
+	    git_path_validate_workdir_buf(iter->base.repo, &root) < 0) {
 		error = -1;
 		goto done;
 	}
@@ -1385,10 +1391,11 @@ static int filesystem_iterator_frame_push(
 		iterator_pathlist_search_t pathlist_match = ITERATOR_PATHLIST_FULL;
 		bool dir_expected = false;
 
-		if ((error = git_path_diriter_fullpath(&path, &path_len, &diriter)) < 0)
+		if ((error = git_path_diriter_fullpath(&path, &path_len, &diriter)) < 0 ||
+		    (error = git_path_validate_workdir_with_len(iter->base.repo, path, path_len)) < 0)
 			goto done;
 
-		assert(path_len > iter->root_len);
+		GIT_ASSERT(path_len > iter->root_len);
 
 		/* remove the prefix if requested */
 		path += iter->root_len;
@@ -1469,17 +1476,19 @@ done:
 	return error;
 }
 
-GIT_INLINE(void) filesystem_iterator_frame_pop(filesystem_iterator *iter)
+GIT_INLINE(int) filesystem_iterator_frame_pop(filesystem_iterator *iter)
 {
 	filesystem_iterator_frame *frame;
 
-	assert(iter->frames.size);
+	GIT_ASSERT(iter->frames.size);
 
 	frame = git_array_pop(iter->frames);
 	filesystem_iterator_frame_pop_ignores(iter);
 
 	git_pool_clear(&frame->entry_pool);
 	git_vector_free(&frame->entries);
+
+	return 0;
 }
 
 static void filesystem_iterator_set_current(
@@ -1556,7 +1565,8 @@ static int filesystem_iterator_is_dir(
 	}
 
 	if ((error = git_buf_joinpath(&fullpath, iter->root, entry->path)) < 0 ||
-		(error = p_stat(fullpath.ptr, &st)) < 0)
+	    (error = git_path_validate_workdir_buf(iter->base.repo, &fullpath)) < 0 ||
+	    (error = p_stat(fullpath.ptr, &st)) < 0)
 		goto done;
 
 	*is_dir = S_ISDIR(st.st_mode);
@@ -1646,7 +1656,7 @@ static int filesystem_iterator_advance_into(
 	 * we will have pushed a new (empty) frame on to the stack for this
 	 * new directory.  since it's empty, its current_entry should be null.
 	 */
-	assert(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
+	GIT_ASSERT(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
 
 	if (prev_entry) {
 		if (prev_entry->st.st_mode != GIT_FILEMODE_COMMIT &&
@@ -1762,12 +1772,13 @@ static int filesystem_iterator_advance_over(
 	*out = NULL;
 	*status = GIT_ITERATOR_STATUS_NORMAL;
 
-	assert(iterator__has_been_accessed(i));
+	GIT_ASSERT(iterator__has_been_accessed(i));
 
 	current_frame = filesystem_iterator_current_frame(iter);
-	assert(current_frame);
+	GIT_ASSERT(current_frame);
+
 	current_entry = filesystem_iterator_current_entry(current_frame);
-	assert(current_entry);
+	GIT_ASSERT(current_entry);
 
 	if ((error = git_iterator_current(&entry, i)) < 0)
 		return error;
@@ -2065,8 +2076,8 @@ static bool index_iterator_create_pseudotree(
 
 static int index_iterator_skip_pseudotree(index_iterator *iter)
 {
-	assert(iterator__has_been_accessed(&iter->base));
-	assert(S_ISDIR(iter->entry->mode));
+	GIT_ASSERT(iterator__has_been_accessed(&iter->base));
+	GIT_ASSERT(S_ISDIR(iter->entry->mode));
 
 	while (true) {
 		const git_index_entry *next_entry = NULL;
@@ -2280,10 +2291,11 @@ int git_iterator_reset_range(
 	return i->cb->reset(i);
 }
 
-void git_iterator_set_ignore_case(git_iterator *i, bool ignore_case)
+int git_iterator_set_ignore_case(git_iterator *i, bool ignore_case)
 {
-	assert(!iterator__has_been_accessed(i));
+	GIT_ASSERT(!iterator__has_been_accessed(i));
 	iterator_set_ignore_case(i, ignore_case);
+	return 0;
 }
 
 void git_iterator_free(git_iterator *iter)