rugged 1.4.2 → 1.5.0

data/vendor/libgit2/src/{pack.c → libgit2/pack.c}

@@ -1001,13 +1001,14 @@ int get_delta_base(
 		base_offset = delta_obj_offset - unsigned_base_offset;
 		*curpos += used;
 	} else if (type == GIT_OBJECT_REF_DELTA) {
+		git_oid base_oid;
+		git_oid_fromraw(&base_oid, base_info);
+
 		/* If we have the cooperative cache, search in it first */
 		if (p->has_cache) {
 			struct git_pack_entry *entry;
-			git_oid oid;
 
-			git_oid_fromraw(&oid, base_info);
-			if ((entry = git_oidmap_get(p->idx_cache, &oid)) != NULL) {
+			if ((entry = git_oidmap_get(p->idx_cache, &base_oid)) != NULL) {
 				if (entry->offset == 0)
 					return packfile_error("delta offset is zero");
 
@@ -1024,7 +1025,7 @@ int get_delta_base(
 		}
 
 		/* The base entry _must_ be in the same pack */
-		if (pack_entry_find_offset(&base_offset, &unused, p, (git_oid *)base_info, GIT_OID_HEXSZ) < 0)
+		if (pack_entry_find_offset(&base_offset, &unused, p, &base_oid, GIT_OID_HEXSZ) < 0)
 			return packfile_error("base entry delta is not in the same pack");
 		*curpos += 20;
 	} else
@@ -1082,7 +1083,7 @@ static int packfile_open_locked(struct git_pack_file *p)
 {
 	struct stat st;
 	struct git_pack_header hdr;
-	git_oid sha1;
+	unsigned char sha1[GIT_OID_RAWSZ];
 	unsigned char *idx_sha1;
 
 	if (pack_index_open_locked(p) < 0)
@@ -1130,12 +1131,12 @@ static int packfile_open_locked(struct git_pack_file *p)
 
 	/* Verify the pack matches its index. */
 	if (p->num_objects != ntohl(hdr.hdr_entries) ||
-		p_pread(p->mwf.fd, sha1.id, GIT_OID_RAWSZ, p->mwf.size - GIT_OID_RAWSZ) < 0)
+	    p_pread(p->mwf.fd, sha1, GIT_OID_RAWSZ, p->mwf.size - GIT_OID_RAWSZ) < 0)
 		goto cleanup;
 
 	idx_sha1 = ((unsigned char *)p->index_map.data) + p->index_map.len - 40;
 
-	if (git_oid__cmp(&sha1, (git_oid *)idx_sha1) != 0)
+	if (git_oid_raw_cmp(sha1, idx_sha1) != 0)
 		goto cleanup;
 
 	if (git_mwindow_file_register(&p->mwf) < 0)
@@ -1340,10 +1341,14 @@ int git_pack_foreach_entry(
 		}
 
 		git_vector_free(&offsets);
-		p->oids = (git_oid **)git_vector_detach(NULL, NULL, &oids);
+		p->oids = (unsigned char **)git_vector_detach(NULL, NULL, &oids);
 	}
 
-	/* We need to copy the OIDs to another array before we relinquish the lock to avoid races. */
+	/*
+	 * We need to copy the OIDs to another array before we
+	 * relinquish the lock to avoid races.  We can also take
+	 * this opportunity to put them into normal form.
+	 */
 	git_array_init_to_size(oids, p->num_objects);
 	if (!oids.ptr) {
 		git_mutex_unlock(&p->lock);
@@ -1357,7 +1362,7 @@ int git_pack_foreach_entry(
 			git_array_clear(oids);
 			GIT_ERROR_CHECK_ALLOC(oid);
 		}
-		git_oid_cpy(oid, p->oids[i]);
+		git_oid_fromraw(oid, p->oids[i]);
 	}
 
 	git_mutex_unlock(&p->lock);
@@ -1380,7 +1385,7 @@ int git_pack_foreach_entry_offset(
 {
 	const unsigned char *index;
 	off64_t current_offset;
-	const git_oid *current_oid;
+	git_oid current_oid;
 	uint32_t i;
 	int error = 0;
 
@@ -1422,8 +1427,9 @@ int git_pack_foreach_entry_offset(
 				current_offset = (((off64_t)ntohl(*((uint32_t *)(large_offset_ptr + 0)))) << 32) |
 						ntohl(*((uint32_t *)(large_offset_ptr + 4)));
 			}
-			current_oid = (const git_oid *)(index + 20 * i);
-			if ((error = cb(current_oid, current_offset, data)) != 0) {
+
+			git_oid_fromraw(&current_oid, (index + 20 * i));
+			if ((error = cb(&current_oid, current_offset, data)) != 0) {
 				error = git_error_set_after_callback(error);
 				goto cleanup;
 			}
@@ -1431,8 +1437,8 @@ int git_pack_foreach_entry_offset(
 	} else {
 		for (i = 0; i < p->num_objects; i++) {
 			current_offset = ntohl(*(const uint32_t *)(index + 24 * i));
-			current_oid = (const git_oid *)(index + 24 * i + 4);
-			if ((error = cb(current_oid, current_offset, data)) != 0) {
+			git_oid_fromraw(&current_oid, (index + 24 * i + 4));
+			if ((error = cb(&current_oid, current_offset, data)) != 0) {
 				error = git_error_set_after_callback(error);
 				goto cleanup;
 			}
@@ -1451,7 +1457,7 @@ int git_pack__lookup_sha1(const void *oid_lookup_table, size_t stride, unsigned
 
 	while (lo < hi) {
 		unsigned mi = (lo + hi) / 2;
-		int cmp = git_oid__hashcmp(base + mi * stride, oid_prefix);
+		int cmp = git_oid_raw_cmp(base + mi * stride, oid_prefix);
 
 		if (!cmp)
 			return mi;
@@ -1530,7 +1536,7 @@ static int pack_entry_find_offset(
 		if (pos < (int)p->num_objects) {
 			current = index + pos * stride;
 
-			if (!git_oid_ncmp(short_oid, (const git_oid *)current, len))
+			if (!git_oid_raw_ncmp(short_oid->id, current, len))
 				found = 1;
 		}
 	}
@@ -1539,7 +1545,7 @@ static int pack_entry_find_offset(
 		/* Check for ambiguousity */
 		const unsigned char *next = current + stride;
 
-		if (!git_oid_ncmp(short_oid, (const git_oid *)next, len)) {
+		if (!git_oid_raw_ncmp(short_oid->id, next, len)) {
 			found = 2;
 		}
 	}

data/vendor/libgit2/src/{pack.h → libgit2/pack.h}

@@ -19,6 +19,7 @@
 #include "offmap.h"
 #include "oidmap.h"
 #include "zstream.h"
+#include "oid.h"
 
 /**
  * Function type for callbacks from git_pack_foreach_entry_offset.
@@ -32,7 +33,7 @@ typedef int git_pack_foreach_entry_offset_cb(
 
 #define PACK_SIGNATURE 0x5041434b	/* "PACK" */
 #define PACK_VERSION 2
-#define pack_version_ok(v) ((v) == htonl(2) || (v) == htonl(3))
+#define pack_version_ok(v) ((v) == htonl(2))
 struct git_pack_header {
 	uint32_t hdr_signature;
 	uint32_t hdr_version;
@@ -104,7 +105,7 @@ struct git_pack_file {
 	git_time_t mtime;
 	unsigned pack_local:1, pack_keep:1, has_cache:1;
 	git_oidmap *idx_cache;
-	git_oid **oids;
+	unsigned char **oids;
 
 	git_pack_cache bases; /* delta base cache */
 

data/vendor/libgit2/src/{path.c → libgit2/path.c}

@@ -9,6 +9,7 @@
 
 #include "repository.h"
 #include "fs_path.h"
+#include "utf8.h"
 
 typedef struct {
 	git_repository *repo;

data/vendor/libgit2/src/{rebase.c → libgit2/rebase.c}

@@ -35,6 +35,7 @@
 #define ONTO_FILE           "onto"
 #define ONTO_NAME_FILE      "onto_name"
 #define QUIET_FILE          "quiet"
+#define INTERACTIVE_FILE    "interactive"
 
 #define MSGNUM_FILE         "msgnum"
 #define END_FILE            "end"
@@ -92,6 +93,7 @@ static int rebase_state_type(
 	git_repository *repo)
 {
 	git_str path = GIT_STR_INIT;
+	git_str interactive_path = GIT_STR_INIT;
 	git_rebase_t type = GIT_REBASE_NONE;
 
 	if (git_str_joinpath(&path, repo->gitdir, REBASE_APPLY_DIR) < 0)
@@ -107,7 +109,14 @@ static int rebase_state_type(
 		return -1;
 
 	if (git_fs_path_isdir(git_str_cstr(&path))) {
-		type = GIT_REBASE_MERGE;
+		if (git_str_joinpath(&interactive_path, path.ptr, INTERACTIVE_FILE) < 0)
+			return -1;
+
+		if (git_fs_path_isfile(interactive_path.ptr))
+			type = GIT_REBASE_INTERACTIVE;
+		else
+			type = GIT_REBASE_MERGE;
+
 		goto done;
 	}
 
@@ -118,6 +127,7 @@ done:
 		*path_out = git_str_detach(&path);
 
 	git_str_dispose(&path);
+	git_str_dispose(&interactive_path);
 
 	return 0;
 }

data/vendor/libgit2/src/{refdb_fs.c → libgit2/refdb_fs.c}

@@ -740,7 +740,7 @@ static int packed_lookup(
 			return 0;
 		}
 	}
-	return GIT_ENOTFOUND;
+	return ref_error_notfound(ref_name);
 
 parse_failed:
 	git_error_set(GIT_ERROR_REFERENCE, "corrupted packed references file");
@@ -1361,7 +1361,11 @@ static int packed_write(refdb_fs_backend *backend)
 
 	for (i = 0; i < git_sortedcache_entrycount(refcache); ++i) {
 		struct packref *ref = git_sortedcache_entry(refcache, i);
-		GIT_ASSERT(ref);
+
+		GIT_ASSERT_WITH_CLEANUP(ref, {
+			error = -1;
+			goto fail;
+		});
 
 		if ((error = packed_find_peel(backend, ref)) < 0)
 			goto fail;

data/vendor/libgit2/src/{remote.c → libgit2/remote.c}

@@ -1830,7 +1830,7 @@ static int update_one_tip(
 	}
 
 	if (error == GIT_ENOTFOUND) {
-		memset(&old, 0, GIT_OID_RAWSZ);
+		memset(&old, 0, sizeof(git_oid));
 		error = 0;
 
 		if (autotag && (error = git_vector_insert(update_heads, head)) < 0)
@@ -1895,8 +1895,11 @@ static int update_tips_for_spec(
 	if (git_oid__is_hexstr(spec->src)) {
 		git_oid id;
 
-		if ((error = git_oid_fromstr(&id, spec->src)) < 0 ||
-		    (error = update_ref(remote, spec->dst, &id, log_message, callbacks)) < 0)
+		if ((error = git_oid_fromstr(&id, spec->src)) < 0)
+			goto on_error;
+
+		if (spec->dst &&
+		     (error = update_ref(remote, spec->dst, &id, log_message, callbacks)) < 0)
 			goto on_error;
 
 		git_oid_cpy(&oid_head.oid, &id);

data/vendor/libgit2/src/{remote.h → libgit2/remote.h}

@@ -11,6 +11,7 @@
 
 #include "git2/remote.h"
 #include "git2/transport.h"
+#include "git2/sys/remote.h"
 #include "git2/sys/transport.h"
 
 #include "refspec.h"
@@ -53,7 +54,6 @@ int git_remote_connect_options_normalize(
 	git_remote_connect_options *dst,
 	git_repository *repo,
 	const git_remote_connect_options *src);
-void git_remote_connect_options_dispose(git_remote_connect_options *opts);
 
 int git_remote_capabilities(unsigned int *out, git_remote *remote);
 

data/vendor/libgit2/src/{repository.c → libgit2/repository.c}

@@ -39,6 +39,7 @@
 # include "win32/w32_util.h"
 #endif
 
+bool git_repository__validate_ownership = true;
 bool git_repository__fsync_gitdir = false;
 
 static const struct {
@@ -65,6 +66,7 @@ static const struct {
 
 static int check_repositoryformatversion(int *version, git_config *config);
 static int check_extensions(git_config *config, int version);
+static int load_global_config(git_config **config);
 
 #define GIT_COMMONDIR_FILE "commondir"
 #define GIT_GITDIR_FILE "gitdir"
@@ -483,6 +485,116 @@ static int read_gitfile(git_str *path_out, const char *file_path)
 	return error;
 }
 
+typedef struct {
+	const char *repo_path;
+	git_str tmp;
+	bool *is_safe;
+} validate_ownership_data;
+
+static int validate_ownership_cb(const git_config_entry *entry, void *payload)
+{
+	validate_ownership_data *data = payload;
+
+	if (strcmp(entry->value, "") == 0)
+		*data->is_safe = false;
+
+	if (git_fs_path_prettify_dir(&data->tmp, entry->value, NULL) == 0 &&
+	    strcmp(data->tmp.ptr, data->repo_path) == 0)
+		*data->is_safe = true;
+
+	return 0;
+}
+
+static int validate_ownership_config(bool *is_safe, const char *path)
+{
+	validate_ownership_data ownership_data = {
+		path, GIT_STR_INIT, is_safe
+	};
+	git_config *config;
+	int error;
+
+	if (load_global_config(&config) != 0)
+		return 0;
+
+	error = git_config_get_multivar_foreach(config,
+		"safe.directory", NULL,
+		validate_ownership_cb,
+		&ownership_data);
+
+	git_config_free(config);
+	git_str_dispose(&ownership_data.tmp);
+
+	return error;
+}
+
+static int validate_ownership_path(bool *is_safe, const char *path)
+{
+	git_fs_path_owner_t owner_level =
+		GIT_FS_PATH_OWNER_CURRENT_USER |
+		GIT_FS_PATH_USER_IS_ADMINISTRATOR |
+		GIT_FS_PATH_OWNER_RUNNING_SUDO;
+	int error = 0;
+
+	if (path)
+		error = git_fs_path_owner_is(is_safe, path, owner_level);
+
+	if (error == GIT_ENOTFOUND) {
+		*is_safe = true;
+		error = 0;
+	}
+
+	return error;
+}
+
+static int validate_ownership(git_repository *repo)
+{
+	const char *validation_paths[3] = { NULL }, *path;
+	size_t validation_len = 0, i;
+	bool is_safe = false;
+	int error = 0;
+
+	/*
+	 * If there's a worktree, validate the permissions to it *and*
+	 * the git directory, and use the worktree as the configuration
+	 * key for allowlisting the directory. In a bare setup, only
+	 * look at the gitdir and use that as the allowlist. So we
+	 * examine all `validation_paths` but use only the first as
+	 * the configuration lookup.
+	 */
+
+	if (repo->workdir)
+		validation_paths[validation_len++] = repo->workdir;
+
+	if (repo->gitlink)
+		validation_paths[validation_len++] = repo->gitlink;
+
+	validation_paths[validation_len++] = repo->gitdir;
+
+	for (i = 0; i < validation_len; i++) {
+		path = validation_paths[i];
+
+		if ((error = validate_ownership_path(&is_safe, path)) < 0)
+			goto done;
+
+		if (!is_safe)
+			break;
+	}
+
+	if (is_safe ||
+	    (error = validate_ownership_config(&is_safe, validation_paths[0])) < 0)
+		goto done;
+
+	if (!is_safe) {
+		git_error_set(GIT_ERROR_CONFIG,
+			"repository path '%s' is not owned by current user",
+			path);
+		error = GIT_EOWNER;
+	}
+
+done:
+	return error;
+}
+
 static int find_repo(
 	git_str *gitdir_path,
 	git_str *workdir_path,
@@ -904,16 +1016,23 @@ int git_repository_open_ext(
 	if ((error = check_extensions(config, version)) < 0)
 		goto cleanup;
 
-	if ((flags & GIT_REPOSITORY_OPEN_BARE) != 0)
+	if ((flags & GIT_REPOSITORY_OPEN_BARE) != 0) {
 		repo->is_bare = 1;
-	else {
-
+	} else {
 		if (config &&
 		    ((error = load_config_data(repo, config)) < 0 ||
 		     (error = load_workdir(repo, config, &workdir)) < 0))
 			goto cleanup;
 	}
 
+	/*
+	 * Ensure that the git directory and worktree are
+	 * owned by the current user.
+	 */
+	if (git_repository__validate_ownership &&
+	    (error = validate_ownership(repo)) < 0)
+		goto cleanup;
+
 cleanup:
 	git_str_dispose(&gitdir);
 	git_str_dispose(&workdir);
@@ -1462,6 +1581,7 @@ static int check_valid_extension(const git_config_entry *entry, void *payload)
 	}
 
 	for (i = 0; i < ARRAY_SIZE(builtin_extensions); i++) {
+		git_str_clear(&cfg);
 		extension = builtin_extensions[i];
 
 		if ((error = git_str_printf(&cfg, "extensions.%s", extension)) < 0)
@@ -1606,13 +1726,40 @@ static bool is_filesystem_case_insensitive(const char *gitdir_path)
 	return is_insensitive;
 }
 
-static bool are_symlinks_supported(const char *wd_path)
+/*
+ * Return a configuration object with only the global and system
+ * configurations; no repository-level configuration.
+ */
+static int load_global_config(git_config **config)
 {
-	git_config *config = NULL;
 	git_str global_buf = GIT_STR_INIT;
 	git_str xdg_buf = GIT_STR_INIT;
 	git_str system_buf = GIT_STR_INIT;
 	git_str programdata_buf = GIT_STR_INIT;
+	int error;
+
+	git_config__find_global(&global_buf);
+	git_config__find_xdg(&xdg_buf);
+	git_config__find_system(&system_buf);
+	git_config__find_programdata(&programdata_buf);
+
+	error = load_config(config, NULL,
+	                    path_unless_empty(&global_buf),
+	                    path_unless_empty(&xdg_buf),
+	                    path_unless_empty(&system_buf),
+	                    path_unless_empty(&programdata_buf));
+
+	git_str_dispose(&global_buf);
+	git_str_dispose(&xdg_buf);
+	git_str_dispose(&system_buf);
+	git_str_dispose(&programdata_buf);
+
+	return error;
+}
+
+static bool are_symlinks_supported(const char *wd_path)
+{
+	git_config *config = NULL;
 	int symlinks = 0;
 
 	/*
@@ -1623,19 +1770,9 @@ static bool are_symlinks_supported(const char *wd_path)
 	 * _not_ set, then we do not test or enable symlink support.
 	 */
 #ifdef GIT_WIN32
-	git_config__find_global(&global_buf);
-	git_config__find_xdg(&xdg_buf);
-	git_config__find_system(&system_buf);
-	git_config__find_programdata(&programdata_buf);
-
-	if (load_config(&config, NULL,
-	    path_unless_empty(&global_buf),
-	    path_unless_empty(&xdg_buf),
-	    path_unless_empty(&system_buf),
-	    path_unless_empty(&programdata_buf)) < 0)
-		goto done;
-
-	if (git_config_get_bool(&symlinks, config, "core.symlinks") < 0 || !symlinks)
+	if (load_global_config(&config) < 0 ||
+	    git_config_get_bool(&symlinks, config, "core.symlinks") < 0 ||
+	    !symlinks)
 		goto done;
 #endif
 
@@ -1643,10 +1780,6 @@ static bool are_symlinks_supported(const char *wd_path)
 		goto done;
 
 done:
-	git_str_dispose(&global_buf);
-	git_str_dispose(&xdg_buf);
-	git_str_dispose(&system_buf);
-	git_str_dispose(&programdata_buf);
 	git_config_free(config);
 	return symlinks != 0;
 }

data/vendor/libgit2/src/{repository.h → libgit2/repository.h}

@@ -34,6 +34,7 @@
 #define GIT_DIR_SHORTNAME "GIT~1"
 
 extern bool git_repository__fsync_gitdir;
+extern bool git_repository__validate_ownership;
 
 /** Cvar cache identifiers */
 typedef enum {