rugged 1.1.1 → 1.2.0

data/vendor/libgit2/src/path.h

@@ -67,8 +67,6 @@ extern int git_path_basename_r(git_buf *buffer, const char *path);
  */
 extern size_t git_path_basename_offset(git_buf *buffer);
 
-extern const char *git_path_topdir(const char *path);
-
 /**
  * Find offset to root of path if path has one.
  *
@@ -285,7 +283,7 @@ extern int git_path_prettify_dir(git_buf *path_out, const char *path, const char
  * appends the trailing '/'.  If the path does not exist, it is
  * treated like a regular filename.
  */
-extern int git_path_find_dir(git_buf *dir, const char *path, const char *base);
+extern int git_path_find_dir(git_buf *dir);
 
 /**
  * Resolve relative references within a path.
@@ -628,20 +626,95 @@ extern int git_path_from_url_or_path(git_buf *local_path_out, const char *url_or
 #define GIT_PATH_REJECT_INDEX_DEFAULTS \
 	GIT_PATH_REJECT_TRAVERSAL | GIT_PATH_REJECT_DOT_GIT
 
-/*
- * Determine whether a path is a valid git path or not - this must not contain
+/**
+ * Validate a "bare" git path.  This ensures that the given path is legal
+ * to place in the index or a tree.  This should be checked by mechanisms
+ * like `git_index_add` and `git_treebuilder_insert` when taking user
+ * data, and by `git_checkout` before constructing on-disk paths.
+ *
+ * This will ensure that a git path does not contain any "unsafe" components,
  * a '.' or '..' component, or a component that is ".git" (in any case).
  *
+ * (Note: if you take or construct an on-disk path -- a workdir path,
+ * a path to a git repository or a reference name that could be a loose
+ * ref -- you should _also_ validate that with `git_path_validate_workdir`.)
+ *
  * `repo` is optional.  If specified, it will be used to determine the short
  * path name to reject (if `GIT_PATH_REJECT_DOS_SHORTNAME` is specified),
  * in addition to the default of "git~1".
  */
-extern bool git_path_isvalid(
+extern bool git_path_validate(
 	git_repository *repo,
 	const char *path,
 	uint16_t mode,
 	unsigned int flags);
 
+/**
+ * Validate an on-disk path, taking into account that it will have a
+ * suffix appended (eg, `.lock`).
+ */
+GIT_INLINE(int) git_path_validate_filesystem_with_suffix(
+	const char *path,
+	size_t path_len,
+	size_t suffix_len)
+{
+#ifdef GIT_WIN32
+	size_t path_chars, total_chars;
+
+	path_chars = git_utf8_char_length(path, path_len);
+
+	if (GIT_ADD_SIZET_OVERFLOW(&total_chars, path_chars, suffix_len) ||
+	    total_chars > MAX_PATH) {
+		git_error_set(GIT_ERROR_FILESYSTEM, "path too long: '%s'", path);
+		return -1;
+	}
+	return 0;
+#else
+	GIT_UNUSED(path);
+	GIT_UNUSED(path_len);
+	GIT_UNUSED(suffix_len);
+	return 0;
+#endif
+}
+
+/**
+ * Validate an path on the filesystem.  This ensures that the given
+ * path is valid for the operating system/platform; for example, this
+ * will ensure that the given absolute path is smaller than MAX_PATH on
+ * Windows.
+ *
+ * For paths within the working directory, you should use ensure that
+ * `core.longpaths` is obeyed.  Use `git_path_validate_workdir`.
+ */
+GIT_INLINE(int) git_path_validate_filesystem(
+	const char *path,
+	size_t path_len)
+{
+	return git_path_validate_filesystem_with_suffix(path, path_len, 0);
+}
+
+/**
+ * Validate a path relative to the repo's worktree.  This ensures that
+ * the given working tree path is valid for the operating system/platform.
+ * This will ensure that an absolute path is smaller than MAX_PATH on
+ * Windows, while keeping `core.longpaths` configuration settings in mind.
+ *
+ * This should be checked by mechamisms like `git_checkout` after
+ * contructing on-disk paths and before trying to write them.
+ *
+ * If the repository is null, no repository configuration is applied.
+ */
+extern int git_path_validate_workdir(
+	git_repository *repo,
+	const char *path);
+extern int git_path_validate_workdir_with_len(
+	git_repository *repo,
+	const char *path,
+	size_t path_len);
+extern int git_path_validate_workdir_buf(
+	git_repository *repo,
+	git_buf *buf);
+
 /**
  * Convert any backslashes into slashes
  */

data/vendor/libgit2/src/pathspec.c

@@ -9,7 +9,6 @@
 
 #include "git2/pathspec.h"
 #include "git2/diff.h"
-#include "buf_text.h"
 #include "attr_file.h"
 #include "iterator.h"
 #include "repository.h"
@@ -25,7 +24,7 @@ char *git_pathspec_prefix(const git_strarray *pathspec)
 	const char *scan;
 
 	if (!pathspec || !pathspec->count ||
-		git_buf_text_common_prefix(&prefix, pathspec) < 0)
+		git_buf_common_prefix(&prefix, pathspec) < 0)
 		return NULL;
 
 	/* diff prefix will only be leading non-wildcards */
@@ -41,7 +40,7 @@ char *git_pathspec_prefix(const git_strarray *pathspec)
 		return NULL;
 	}
 
-	git_buf_text_unescape(&prefix);
+	git_buf_unescape(&prefix);
 
 	return git_buf_detach(&prefix);
 }
@@ -289,7 +288,8 @@ int git_pathspec_matches_path(
 	bool no_fnmatch = (flags & GIT_PATHSPEC_NO_GLOB) != 0;
 	bool casefold =  (flags & GIT_PATHSPEC_IGNORE_CASE) != 0;
 
-	assert(ps && path);
+	GIT_ASSERT_ARG(ps);
+	GIT_ASSERT_ARG(path);
 
 	return (0 != git_pathspec__match(
 		&ps->pathspec, path, no_fnmatch, casefold, NULL, NULL));
@@ -526,7 +526,7 @@ int git_pathspec_match_workdir(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -548,7 +548,7 @@ int git_pathspec_match_index(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -570,7 +570,7 @@ int git_pathspec_match_tree(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(tree);
+	GIT_ASSERT_ARG(tree);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -598,7 +598,7 @@ int git_pathspec_match_diff(
 	const git_diff_delta *delta, **match;
 	git_bitvec used_patterns;
 
-	assert(diff);
+	GIT_ASSERT_ARG(diff);
 
 	if (git_bitvec_init(&used_patterns, patterns->length) < 0)
 		return -1;

data/vendor/libgit2/src/pool.c

@@ -36,8 +36,8 @@ int git_pool_global_init(void)
 
 int git_pool_init(git_pool *pool, size_t item_size)
 {
-	assert(pool);
-	assert(item_size >= 1);
+	GIT_ASSERT_ARG(pool);
+	GIT_ASSERT_ARG(item_size >= 1);
 
 	memset(pool, 0, sizeof(git_pool));
 	pool->item_size = item_size;
@@ -131,8 +131,8 @@ static int git_pool__ptr_cmp(const void * a, const void * b)
 
 int git_pool_init(git_pool *pool, size_t item_size)
 {
-	assert(pool);
-	assert(item_size >= 1);
+	GIT_ASSERT_ARG(pool);
+	GIT_ASSERT_ARG(item_size >= 1);
 
 	memset(pool, 0, sizeof(git_pool));
 	pool->item_size = item_size;
@@ -205,7 +205,9 @@ char *git_pool_strndup(git_pool *pool, const char *str, size_t n)
 {
 	char *ptr = NULL;
 
-	assert(pool && str && pool->item_size == sizeof(char));
+	GIT_ASSERT_ARG_WITH_RETVAL(pool, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(str, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(pool->item_size == sizeof(char), NULL);
 
 	if (n == SIZE_MAX)
 		return NULL;
@@ -220,7 +222,10 @@ char *git_pool_strndup(git_pool *pool, const char *str, size_t n)
 
 char *git_pool_strdup(git_pool *pool, const char *str)
 {
-	assert(pool && str && pool->item_size == sizeof(char));
+	GIT_ASSERT_ARG_WITH_RETVAL(pool, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(str, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(pool->item_size == sizeof(char), NULL);
+
 	return git_pool_strndup(pool, str, strlen(str));
 }
 
@@ -234,7 +239,8 @@ char *git_pool_strcat(git_pool *pool, const char *a, const char *b)
 	void *ptr;
 	size_t len_a, len_b, total;
 
-	assert(pool && pool->item_size == sizeof(char));
+	GIT_ASSERT_ARG_WITH_RETVAL(pool, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(pool->item_size == sizeof(char), NULL);
 
 	len_a = a ? strlen(a) : 0;
 	len_b = b ? strlen(b) : 0;

data/vendor/libgit2/src/posix.c

@@ -109,6 +109,13 @@ int p_open(const char *path, volatile int flags, ...)
 {
 	mode_t mode = 0;
 
+	#ifdef GIT_DEBUG_STRICT_OPEN
+	if (strstr(path, "//") != NULL) {
+		errno = EACCES;
+		return -1;
+	}
+	#endif
+
 	if (flags & O_CREAT) {
 		va_list arg_list;
 
@@ -129,7 +136,8 @@ int p_getcwd(char *buffer_out, size_t size)
 {
 	char *cwd_buffer;
 
-	assert(buffer_out && size > 0);
+	GIT_ASSERT_ARG(buffer_out);
+	GIT_ASSERT_ARG(size > 0);
 
 	cwd_buffer = getcwd(buffer_out, size);
 
@@ -196,7 +204,7 @@ int p_write(git_file fd, const void *buf, size_t cnt)
 	while (cnt) {
 		ssize_t r;
 #ifdef GIT_WIN32
-		assert((size_t)((unsigned int)cnt) == cnt);
+		GIT_ASSERT((size_t)((unsigned int)cnt) == cnt);
 		r = write(fd, b, (unsigned int)cnt);
 #else
 		r = write(fd, b, cnt);
@@ -282,7 +290,7 @@ int p_mmap(git_map *out, size_t len, int prot, int flags, int fd, off64_t offset
 
 int p_munmap(git_map *map)
 {
-	assert(map != NULL);
+	GIT_ASSERT_ARG(map);
 	git__free(map->data);
 
 	/* Initializing will help debug use-after-free */

data/vendor/libgit2/src/reader.c

@@ -61,7 +61,8 @@ int git_reader_for_tree(git_reader **out, git_tree *tree)
 {
 	tree_reader *reader;
 
-	assert(out && tree);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(tree);
 
 	reader = git__calloc(1, sizeof(tree_reader));
 	GIT_ERROR_CHECK_ALLOC(reader);
@@ -97,8 +98,7 @@ static int workdir_reader_read(
 	git_oid id;
 	int error;
 
-	if ((error = git_buf_joinpath(&path,
-		git_repository_workdir(reader->repo), filename)) < 0)
+	if ((error = git_repository_workdir_path(&path, reader->repo, filename)) < 0)
 		goto done;
 
 	if ((error = p_lstat(path.ptr, &st)) < 0) {
@@ -158,7 +158,8 @@ int git_reader_for_workdir(
 	workdir_reader *reader;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	reader = git__calloc(1, sizeof(workdir_reader));
 	GIT_ERROR_CHECK_ALLOC(reader);
@@ -223,7 +224,8 @@ int git_reader_for_index(
 	index_reader *reader;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	reader = git__calloc(1, sizeof(index_reader));
 	GIT_ERROR_CHECK_ALLOC(reader);
@@ -251,7 +253,9 @@ int git_reader_read(
 	git_reader *reader,
 	const char *filename)
 {
-	assert(out && reader && filename);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(reader);
+	GIT_ASSERT_ARG(filename);
 
 	return reader->read(out, out_id, out_filemode, reader, filename);
 }

data/vendor/libgit2/src/rebase.c

@@ -186,8 +186,8 @@ static git_rebase_operation *rebase_operation_alloc(
 {
 	git_rebase_operation *operation;
 
-	assert((type == GIT_REBASE_OPERATION_EXEC) == !id);
-	assert((type == GIT_REBASE_OPERATION_EXEC) == !!exec);
+	GIT_ASSERT_WITH_RETVAL((type == GIT_REBASE_OPERATION_EXEC) == !id, NULL);
+	GIT_ASSERT_WITH_RETVAL((type == GIT_REBASE_OPERATION_EXEC) == !!exec, NULL);
 
 	if ((operation = git_array_alloc(rebase->operations)) == NULL)
 		return NULL;
@@ -301,7 +301,7 @@ int git_rebase_open(
 	size_t state_path_len;
 	int error;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	if ((error = rebase_check_versions(given_opts)) < 0)
 		return error;
@@ -701,7 +701,8 @@ int git_rebase_init(
 	bool inmemory = (given_opts && given_opts->inmemory);
 	int error;
 
-	assert(repo && (upstream || onto));
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(upstream || onto);
 
 	*out = NULL;
 
@@ -912,7 +913,8 @@ int git_rebase_next(
 {
 	int error;
 
-	assert(out && rebase);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(rebase);
 
 	if ((error = rebase_movenext(rebase)) < 0)
 		return error;
@@ -931,7 +933,9 @@ int git_rebase_inmemory_index(
 	git_index **out,
 	git_rebase *rebase)
 {
-	assert(out && rebase && rebase->index);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(rebase);
+	GIT_ASSERT_ARG(rebase->index);
 
 	GIT_REFCOUNT_INC(rebase->index);
 	*out = rebase->index;
@@ -939,6 +943,54 @@ int git_rebase_inmemory_index(
 	return 0;
 }
 
+#ifndef GIT_DEPRECATE_HARD
+static int create_signed(
+	git_oid *out,
+	git_rebase *rebase,
+	const git_signature *author,
+	const git_signature *committer,
+	const char *message_encoding,
+	const char *message,
+	git_tree *tree,
+	size_t parent_count,
+	const git_commit **parents)
+{
+	git_buf commit_content = GIT_BUF_INIT,
+	        commit_signature = GIT_BUF_INIT,
+	        signature_field = GIT_BUF_INIT;
+	int error;
+
+	git_error_clear();
+
+	if ((error = git_commit_create_buffer(&commit_content,
+		rebase->repo, author, committer, message_encoding,
+		message, tree, parent_count, parents)) < 0)
+		goto done;
+
+	error = rebase->options.signing_cb(&commit_signature,
+		&signature_field, commit_content.ptr,
+		rebase->options.payload);
+
+	if (error) {
+		if (error != GIT_PASSTHROUGH)
+			git_error_set_after_callback_function(error, "signing_cb");
+
+		goto done;
+	}
+
+	error = git_commit_create_with_signature(out, rebase->repo,
+		commit_content.ptr,
+		commit_signature.size > 0 ? commit_signature.ptr : NULL,
+		signature_field.size > 0 ? signature_field.ptr : NULL);
+
+done:
+	git_buf_dispose(&commit_signature);
+	git_buf_dispose(&signature_field);
+	git_buf_dispose(&commit_content);
+	return error;
+}
+#endif
+
 static int rebase_commit__create(
 	git_commit **out,
 	git_rebase *rebase,
@@ -953,10 +1005,6 @@ static int rebase_commit__create(
 	git_commit *current_commit = NULL, *commit = NULL;
 	git_tree *parent_tree = NULL, *tree = NULL;
 	git_oid tree_id, commit_id;
-	git_buf commit_content = GIT_BUF_INIT, commit_signature = GIT_BUF_INIT,
-		signature_field = GIT_BUF_INIT;
-	const char *signature_field_string = NULL,
-		*commit_signature_string = NULL;
 	int error;
 
 	operation = git_array_get(rebase->operations, rebase->current);
@@ -987,37 +1035,32 @@ static int rebase_commit__create(
 		message = git_commit_message(current_commit);
 	}
 
-	if ((error = git_commit_create_buffer(&commit_content, rebase->repo, author, committer,
-			message_encoding, message, tree, 1, (const git_commit **)&parent_commit)) < 0)
-		goto done;
+	git_error_clear();
+	error = GIT_PASSTHROUGH;
 
-	if (rebase->options.signing_cb) {
-		git_error_clear();
-		error = git_error_set_after_callback_function(rebase->options.signing_cb(
-			&commit_signature, &signature_field, git_buf_cstr(&commit_content),
-			rebase->options.payload), "commit signing_cb failed");
-		if (error == GIT_PASSTHROUGH) {
-			git_buf_dispose(&commit_signature);
-			git_buf_dispose(&signature_field);
-			git_error_clear();
-			error = GIT_OK;
-		} else if (error < 0)
-			goto done;
-	}
+	if (rebase->options.commit_create_cb) {
+		error = rebase->options.commit_create_cb(&commit_id,
+			author, committer, message_encoding, message,
+			tree, 1, (const git_commit **)&parent_commit,
+			rebase->options.payload);
 
-	if (git_buf_is_allocated(&commit_signature)) {
-		assert(git_buf_contains_nul(&commit_signature));
-		commit_signature_string = git_buf_cstr(&commit_signature);
+		git_error_set_after_callback_function(error,
+			"commit_create_cb");
 	}
-
-	if (git_buf_is_allocated(&signature_field)) {
-		assert(git_buf_contains_nul(&signature_field));
-		signature_field_string = git_buf_cstr(&signature_field);
+#ifndef GIT_DEPRECATE_HARD
+	else if (rebase->options.signing_cb) {
+		error = create_signed(&commit_id, rebase, author,
+			committer, message_encoding, message, tree,
+			1, (const git_commit **)&parent_commit);
 	}
+#endif
 
-	if ((error = git_commit_create_with_signature(&commit_id, rebase->repo,
-			git_buf_cstr(&commit_content), commit_signature_string,
-			signature_field_string)))
+	if (error == GIT_PASSTHROUGH)
+		error = git_commit_create(&commit_id, rebase->repo, NULL,
+			author, committer, message_encoding, message,
+			tree, 1, (const git_commit **)&parent_commit);
+
+	if (error)
 		goto done;
 
 	if ((error = git_commit_lookup(&commit, rebase->repo, &commit_id)) < 0)
@@ -1029,9 +1072,6 @@ done:
 	if (error < 0)
 		git_commit_free(commit);
 
-	git_buf_dispose(&commit_signature);
-	git_buf_dispose(&signature_field);
-	git_buf_dispose(&commit_content);
 	git_commit_free(current_commit);
 	git_tree_free(parent_tree);
 	git_tree_free(tree);
@@ -1055,7 +1095,7 @@ static int rebase_commit_merge(
 	int error;
 
 	operation = git_array_get(rebase->operations, rebase->current);
-	assert(operation);
+	GIT_ASSERT(operation);
 
 	if ((error = rebase_ensure_not_dirty(rebase->repo, false, true, GIT_EUNMERGED)) < 0 ||
 		(error = git_repository_head(&head, rebase->repo)) < 0 ||
@@ -1095,9 +1135,9 @@ static int rebase_commit_inmemory(
 	git_commit *commit = NULL;
 	int error = 0;
 
-	assert(rebase->index);
-	assert(rebase->last_commit);
-	assert(rebase->current < rebase->operations.size);
+	GIT_ASSERT_ARG(rebase->index);
+	GIT_ASSERT_ARG(rebase->last_commit);
+	GIT_ASSERT_ARG(rebase->current < rebase->operations.size);
 
 	if ((error = rebase_commit__create(&commit, rebase, rebase->index,
 		rebase->last_commit, author, committer, message_encoding, message)) < 0)
@@ -1125,7 +1165,8 @@ int git_rebase_commit(
 {
 	int error;
 
-	assert(rebase && committer);
+	GIT_ASSERT_ARG(rebase);
+	GIT_ASSERT_ARG(committer);
 
 	if (rebase->inmemory)
 		error = rebase_commit_inmemory(
@@ -1145,7 +1186,7 @@ int git_rebase_abort(git_rebase *rebase)
 	git_commit *orig_head_commit = NULL;
 	int error;
 
-	assert(rebase);
+	GIT_ASSERT_ARG(rebase);
 
 	if (rebase->inmemory)
 		return 0;
@@ -1358,7 +1399,7 @@ int git_rebase_finish(
 {
 	int error = 0;
 
-	assert(rebase);
+	GIT_ASSERT_ARG(rebase);
 
 	if (rebase->inmemory)
 		return 0;
@@ -1373,14 +1414,17 @@ int git_rebase_finish(
 }
 
 const char *git_rebase_orig_head_name(git_rebase *rebase) {
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 	return rebase->orig_head_name;
 }
 
 const git_oid *git_rebase_orig_head_id(git_rebase *rebase) {
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 	return &rebase->orig_head_id;
 }
 
 const char *git_rebase_onto_name(git_rebase *rebase) {
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 	return rebase->onto_name;
 }
 
@@ -1390,21 +1434,21 @@ const git_oid *git_rebase_onto_id(git_rebase *rebase) {
 
 size_t git_rebase_operation_entrycount(git_rebase *rebase)
 {
-	assert(rebase);
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, 0);
 
 	return git_array_size(rebase->operations);
 }
 
 size_t git_rebase_operation_current(git_rebase *rebase)
 {
-	assert(rebase);
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, 0);
 
 	return rebase->started ? rebase->current : GIT_REBASE_NO_OPERATION;
 }
 
 git_rebase_operation *git_rebase_operation_byindex(git_rebase *rebase, size_t idx)
 {
-	assert(rebase);
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 
 	return git_array_get(rebase->operations, idx);
 }