<feed xmlns='http://www.w3.org/2005/Atom'>
<title>delta/libgit2.git, branch cmn/format-security</title>
<subtitle>github.com: libgit2/libgit2.git
</subtitle>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/'/>
<entry>
<title>cmake: enable -Wformat and -Wformat-security</title>
<updated>2018-09-17T18:38:05+00:00</updated>
<author>
<name>Carlos Martín Nieto</name>
<email>cmn@dwim.me</email>
</author>
<published>2018-09-17T18:38:05+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=f2c1153d4fa09a36be7c6b87e4f55325f6e5031e'/>
<id>f2c1153d4fa09a36be7c6b87e4f55325f6e5031e</id>
<content type='text'>
We do not currently have any warnings in this regard, but it's good practice to
have them on in case we introduce something.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
We do not currently have any warnings in this regard, but it's good practice to
have them on in case we introduce something.
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #4778 from libgit2/ethomson/clar-xml</title>
<updated>2018-09-09T15:44:21+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2018-09-09T15:44:21+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=bc34cb63ff5b2bc51bcdec7dfc41202dfc34e97f'/>
<id>bc34cb63ff5b2bc51bcdec7dfc41202dfc34e97f</id>
<content type='text'>
Clar XML output redux</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Clar XML output redux</pre>
</div>
</content>
</entry>
<entry>
<title>clar: iterate errors in report_all / report_errors</title>
<updated>2018-09-08T18:47:25+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2018-09-08T17:54:21+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=d17e67d08d6e73dbf0daeae5049f92a38c2d8bb6'/>
<id>d17e67d08d6e73dbf0daeae5049f92a38c2d8bb6</id>
<content type='text'>
Instead of trying to have a clever iterator pattern that increments the
error number, just iterate over errors in the report errors or report
all functions as it's easier to reason about in this fashion.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Instead of trying to have a clever iterator pattern that increments the
error number, just iterate over errors in the report errors or report
all functions as it's easier to reason about in this fashion.
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #4785 from tiennou/fix/cleanup-remote</title>
<updated>2018-09-07T11:20:33+00:00</updated>
<author>
<name>Patrick Steinhardt</name>
<email>ps@pks.im</email>
</author>
<published>2018-09-07T11:20:33+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=55d354d8ba2abd858e5745451502a147d70a0a6f'/>
<id>55d354d8ba2abd858e5745451502a147d70a0a6f</id>
<content type='text'>
remote: store the connection data in a private struct</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
remote: store the connection data in a private struct</pre>
</div>
</content>
</entry>
<entry>
<title>remote: store the connection data in a private struct</title>
<updated>2018-09-07T10:37:22+00:00</updated>
<author>
<name>Etienne Samson</name>
<email>samson.etienne@gmail.com</email>
</author>
<published>2018-09-07T10:36:15+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=1c176883880c4f487597074c70f9bb6f96198737'/>
<id>1c176883880c4f487597074c70f9bb6f96198737</id>
<content type='text'>
This makes it easier to pass connection-related options around (proxy &amp;
custom headers for now).

This fixes a bug in git_push_finish, which didn't reuse the provided
proxy if the connection closed between the call to `git_remote_push` and
the finish step.</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This makes it easier to pass connection-related options around (proxy &amp;
custom headers for now).

This fixes a bug in git_push_finish, which didn't reuse the provided
proxy if the connection closed between the call to `git_remote_push` and
the finish step.</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #4789 from pks-t/pks/licensing</title>
<updated>2018-09-06T18:22:30+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2018-09-06T18:22:30+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=db17b31baa2af5c0dda4ae43bc09ebd519471ae4'/>
<id>db17b31baa2af5c0dda4ae43bc09ebd519471ae4</id>
<content type='text'>
docs: clarify and include licenses of dependencies</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
docs: clarify and include licenses of dependencies</pre>
</div>
</content>
</entry>
<entry>
<title>Merge pull request #4799 from pks-t/pks/config-multivar-quadratic</title>
<updated>2018-09-06T18:19:58+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2018-09-06T18:19:58+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=0bcb1d5fabfa9e3170b1de0bd6603758ce2a39d0'/>
<id>0bcb1d5fabfa9e3170b1de0bd6603758ce2a39d0</id>
<content type='text'>
config_file: fix quadratic behaviour when adding config multivars</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
config_file: fix quadratic behaviour when adding config multivars</pre>
</div>
</content>
</entry>
<entry>
<title>config_file: fix quadratic behaviour when adding config multivars</title>
<updated>2018-09-06T12:27:02+00:00</updated>
<author>
<name>Patrick Steinhardt</name>
<email>ps@pks.im</email>
</author>
<published>2018-09-06T12:17:54+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=f26946358f0ddf106f54e4a9d7eaaf7b60a2c20f'/>
<id>f26946358f0ddf106f54e4a9d7eaaf7b60a2c20f</id>
<content type='text'>
In case where we add multiple configuration entries with the same key to
a diskfile backend, we always need to iterate the list of this key to
find the last entry due to the list being a singly-linked list. This
is obviously quadratic behaviour, and this has sure enough been found by
oss-fuzz by generating a configuration file with 50k lines, where most
of them have the same key. While the issue will not arise with "sane"
configuration files, an adversary may trigger it by providing a crafted
".gitmodules" file, which is delivered as part of the repo and also
parsed by the configuration parser.

The fix is trivial: store a pointer to the last entry of the list in its
head. As there are only two locations now where we append to this data
structure, mainting this pointer is trivial, too. We can also optimize
retrieval of a single value via `config_get`, where we previously had to
chase the `next` pointer to find the last entry that was added.

Using our configuration file fozzur with a corpus that has a single file
with 50000 "-=" lines previously took around 21s. With this optimization
the same file scans in about 0.053s, which is a nearly 400-fold
improvement. But in most cases with a "normal" amount of same-named keys
it's not going to matter anyway.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In case where we add multiple configuration entries with the same key to
a diskfile backend, we always need to iterate the list of this key to
find the last entry due to the list being a singly-linked list. This
is obviously quadratic behaviour, and this has sure enough been found by
oss-fuzz by generating a configuration file with 50k lines, where most
of them have the same key. While the issue will not arise with "sane"
configuration files, an adversary may trigger it by providing a crafted
".gitmodules" file, which is delivered as part of the repo and also
parsed by the configuration parser.

The fix is trivial: store a pointer to the last entry of the list in its
head. As there are only two locations now where we append to this data
structure, mainting this pointer is trivial, too. We can also optimize
retrieval of a single value via `config_get`, where we previously had to
chase the `next` pointer to find the last entry that was added.

Using our configuration file fozzur with a corpus that has a single file
with 50000 "-=" lines previously took around 21s. With this optimization
the same file scans in about 0.053s, which is a nearly 400-fold
improvement. But in most cases with a "normal" amount of same-named keys
it's not going to matter anyway.
</pre>
</div>
</content>
</entry>
<entry>
<title>ci: use more compatible strftime formats</title>
<updated>2018-09-06T10:18:59+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2018-08-27T00:06:37+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=e595eeb5ab88142b97798ed65e651de6560515e9'/>
<id>e595eeb5ab88142b97798ed65e651de6560515e9</id>
<content type='text'>
Windows lacks %F and %T formats for strftime.  Expand them to the
year/month/day and hour/minute/second formats, respectively.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Windows lacks %F and %T formats for strftime.  Expand them to the
year/month/day and hour/minute/second formats, respectively.
</pre>
</div>
</content>
</entry>
<entry>
<title>ci: use templates for VSTS builds</title>
<updated>2018-09-06T10:18:59+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2018-08-26T17:05:31+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/libgit2.git/commit/?id=6b2d8f09bc9e5bdf74f98b7470ebc39436be600f'/>
<id>6b2d8f09bc9e5bdf74f98b7470ebc39436be600f</id>
<content type='text'>
Our build YAML is becoming unweildly and full of copy-pasta.  Simplify
with templates.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Our build YAML is becoming unweildly and full of copy-pasta.  Simplify
with templates.
</pre>
</div>
</content>
</entry>
</feed>
