summaryrefslogtreecommitdiff
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* winhttp: refactor request sendingEdward Thomson2020-01-241-8/+8
| | | | | Clarify what it means to not send a length; this allows us to refactor requests further.
* smart protocol: correct case in error messagesEdward Thomson2020-01-241-4/+4
|
* gssapi: validate that we were requested NegotiateEdward Thomson2020-01-241-3/+5
|
* gssapi: dispose after completion for retryEdward Thomson2020-01-241-13/+19
| | | | | | Disposal pattern; dispose on completion, allowing us to retry authentication, which may happen on web servers that close connection-based authenticated sessions (NTLM/SPNEGO) unexpectedly.
* gssapi: delete half-built security context so auth can continueJonathan Turcotte2020-01-241-3/+3
|
* gssapi: correct incorrect case in error messageEdward Thomson2020-01-241-1/+1
|
* gssapi: protect GSS_ERROR macroEdward Thomson2020-01-241-4/+7
| | | | | | | | | | | The GSS_ERROR(x) macro may expand to `(x & value)` on some implementations, instead of `((x) & value)`. This is the case on macOS, which means that if we attempt to wrap an expression in that macro, like `a = b`, then that would expand to `(a = b & value)`. Since `&` has a higher precedence, this is not at all what we want, and will set our result code to an incorrect value. Evaluate the expression then test it with `GSS_ERROR` independently to avoid this.
* gssapi: protect against empty messagesEdward Thomson2020-01-241-0/+6
|
* auth: update enum type name for consistencyethomson/typetEdward Thomson2020-01-185-13/+13
| | | | | libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_http_authtype_t` to `git_http_auth_t` for consistency.
* iterator: update enum type name for consistencyEdward Thomson2020-01-189-50/+50
| | | | | libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_iterator_type_t` to `git_iterator_t` for consistency.
* rebase: update enum type name for consistencyEdward Thomson2020-01-181-21/+21
| | | | | libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_rebase_type_t` to `git_rebase_t` for consistency.
* merge: update enum type name for consistencyEdward Thomson2020-01-181-2/+2
| | | | | libgit2 does not use `type_t` suffixes as it's redundant; thus, rename `git_merge_diff_type_t` to `git_merge_diff_t` for consistency.
* Merge pull request #5358 from lrm29/git_merge_driver_source_repo_non_constPatrick Steinhardt2020-01-171-1/+1
|\ | | | | merge: Return non-const git_repository from accessor method
| * merge: Return non-const git_repository from git_merge_driver_source_repo ↵Laurence McGlashan2020-01-151-1/+1
| | | | | | | | accessor.
* | Merge pull request #5361 from csware/no-return-freed_objectPatrick Steinhardt2020-01-171-2/+1
|\ \ | | | | | | Do not return free'd git_repository object on error
| * | Do not return free'd git_repository object on errorSven Strickroth2020-01-161-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | Regression introduced in commit dde6d9c706bf1ecab545da55ab874a016587af1f. This issue causes lots of crashes in TortoiseGit. Signed-off-by: Sven Strickroth <email@cs-ware.de>
* | | Merge pull request #5360 from josharian/fix-5357Patrick Steinhardt2020-01-171-0/+5
|\ \ \ | | | | | | | | refs: refuse to delete HEAD
| * | | refs: refuse to delete HEADJosh Bleecher Snyder2020-01-151-0/+5
| |/ / | | | | | | | | | | | | | | | | | | This requires adding a new symbolic ref to the testrepo fixture. Some of the existing tests attempt to delete HEAD, expecting a different failure. Introduce and use a non-HEAD symbolic ref instead. Adjust a few other tests as needed. Fixes #5357
* | | Merge pull request #5351 from pks-t/pks/index-map-macrosEdward Thomson2020-01-161-60/+48
|\ \ \ | |/ / |/| | index: replace map macros with inline functions
| * | index: fix resizing index map twice on case-insensitive systemsPatrick Steinhardt2020-01-141-17/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Depending on whether the index map is case-sensitive or insensitive, we need to call either `git_idxmap_icase_resize` or `git_idxmap_resize`. There are multiple locations where we thus use the following pattern: if (index->ignore_case && git_idxmap_icase_resize(map, length) < 0) return -1; else if (git_idxmap_resize(map, length) < 0) return -1; The funny thing is: on case-insensitive systems, we will try to resize the map twice in case where `git_idxmap_icase_resize()` doesn't error. While this will still use the correct hashing function as both map types use the same, this bug will at least cause us to resize the map twice in a row. Fix the issue by introducing a new function `index_map_resize` that handles case-sensitivity, similar to how `index_map_set` and `index_map_delete`. Convert all call sites where we were previously resizing the map to use that new function.
| * | index: replace map macros with inline functionsPatrick Steinhardt2020-01-141-43/+34
| |/ | | | | | | | | | | | | | | | | | | | | Traditionally, our maps were mostly implemented via macros that had weird call semantics. This shows in our index code, where we have macros that insert into an index map case-sensitively or insensitively, as they still return error codes via an error parameter. This is unwieldy and, most importantly, not necessary anymore, due to the introduction of our high-level map API and removal of macros. Replace them with inlined functions to make code easier to read.
* | Make type mismatch errors consistentTobias Nießen2020-01-152-2/+2
|/
* Merge pull request #5355 from pks-t/pks/win32-relative-symlink-across-dirsEdward Thomson2020-01-121-1/+9
|\ | | | | win32: fix relative symlinks pointing into dirs
| * win32: fix relative symlinks pointing into dirsPatrick Steinhardt2020-01-101-1/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On Windows platforms, we need some logic to emulate symlink(3P) defined by POSIX. As unprivileged symlinks on Windows are a rather new feature, our current implementation is comparatively new and still has some rough edges in special cases. One such case is relative symlinks. While relative symlinks to files in the same directory work as expected, libgit2 currently fails to create reltaive symlinks pointing into other directories. This is due to the fact that we forgot to translate the Unix-style target path to Windows-style. Most importantly, we are currently not converting directory separators from "/" to "\". Fix the issue by calling `git_win32_path_canonicalize` on the target. Add a test that verifies our ability to create such relative links across directories.
* | Merge pull request #5305 from kas-luthor/bugfix/multiple-authPatrick Steinhardt2020-01-101-0/+8
|\ \ | |/ |/| Adds support for multiple SSH auth mechanisms being used sequentially
| * Fixes code stylingkas2019-12-131-5/+3
| |
| * Adds support for multiple SSH auth mechanisms being used sequentiallykas2019-11-161-0/+10
| |
* | netops: handle intact query parameters in service_suffix removalJosh Bleecher Snyder2020-01-091-8/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | Some servers leave the query parameters intact in the Location header when responding with a redirect. The service_suffix removal check as written assumed that the server removed them. Handle both cases. Along with PR #5325, this fixes #5321. There are two new tests. The first already passed; the second previously failed.
* | pack: refactor streams to use `git_zstream`Patrick Steinhardt2020-01-092-47/+19
| | | | | | | | | | | | While we do have a `git_zstream` abstraction that encapsulates all the calls to zlib as well as its error handling, we do not use it in our pack file code. Refactor it to make the code a lot easier to understand.
* | pack: refactor unpacking of raw objects to use `git_zstream`Patrick Steinhardt2020-01-093-41/+44
| | | | | | | | | | | | While we do have a zstream abstraction that encapsulates all the calls to zlib as well as its error handling, we do not use it in our pack file code. Refactor it to make the code a lot easier to understand.
* | Merge pull request #5322 from kdj0c/fix_sub_syncEdward Thomson2020-01-081-56/+49
|\ \ | | | | | | Fix git_submodule_sync with relative url
| * | submodule: refactor code to match current coding stylePatrick Steinhardt2020-01-061-57/+48
| | | | | | | | | | | | | | | | | | The submodule code has grown out-of-date regarding its coding style. Update `git_submodule_reload` and `git_submodule_sync` to more closely resemble what the rest of our code base uses.
| * | submodule sync, fix edge case with submodule sync on empty repokdj0c2020-01-061-1/+1
| | |
| * | Fix git_submodule_sync with relative urlkdj0c2020-01-061-4/+6
| | | | | | | | | | | | | | | git_submodule_sync should resolve submodule before writing to .git/config to have the same behavior as git_submodule_init, which does the right thing.
* | | Merge pull request #5325 from josharian/no-double-slashPatrick Steinhardt2020-01-062-3/+11
|\ \ \ | | | | | | | | http: avoid generating double slashes in url
| * | | http: avoid generating double slashes in urlJosh Bleecher Snyder2019-12-132-3/+11
| |/ / | | | | | | | | | | | | | | | | | | | | | Prior to this change, given a remote url with a trailing slash, such as http://localhost/a/, service requests would contain a double slash: http://localhost/a//info/refs?service=git-receive-pack. Detect and prevent that. Updates #5321
* | | Merge pull request #5338 from pks-t/pks/patch-null-arithmeticEdward Thomson2019-12-141-2/+6
|\ \ \ | | | | | | | | patch_parse: fix undefined behaviour due to arithmetic on NULL pointers
| * | | patch_parse: fix undefined behaviour due to arithmetic on NULL pointersPatrick Steinhardt2019-12-131-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Doing arithmetic with NULL pointers is undefined behaviour in the C standard. We do so regardless when parsing patches, as we happily add a potential prefix length to prefixed paths. While this works out just fine as the prefix length is always equal to zero in these cases, thus resulting in another NULL pointer, it still is undefined behaviour and was pointed out to us by OSSfuzz. Fix the issue by checking whether paths are NULL, avoiding the arithmetic if they are.
* | | | Merge pull request #5337 from pks-t/pks/smart-pkt-ok-overflowEdward Thomson2019-12-141-1/+1
|\ \ \ \ | |_|/ / |/| | | smart_pkt: fix overflow resulting in OOB read/write of one byte
| * | | smart_pkt: fix overflow resulting in OOB read/write of one bytePatrick Steinhardt2019-12-131-1/+1
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When parsing OK packets, we copy any information after the initial "ok " prefix into the resulting packet. As newlines act as packet boundaries, we also strip the trailing newline if there is any. We do not check whether there is any data left after the initial "ok " prefix though, which leads to a pointer overflow in that case as `len == 0`: if (line[len - 1] == '\n') --len; This out-of-bounds read is a rather useless gadget, as we can only deduce whether at some offset there is a newline character. In case there accidentally is one, we overflow `len` to `SIZE_MAX` and then write a NUL byte into an array indexed by it: pkt->ref[len] = '\0'; Again, this doesn't seem like something that's possible to be exploited in any meaningful way, but it may surely lead to inconsistencies or DoS. Fix the issue by checking whether there is any trailing data after the packet prefix.
* | | Merge pull request #5300 from tiennou/fix/branch-documentationPatrick Steinhardt2019-12-134-35/+51
|\ \ \ | |/ / |/| | branch: clarify documentation around branches
| * | refs: rename git_reference__set_name to git_reference__reallocEtienne Samson2019-12-133-8/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As git_reference__name will reallocate storage to account for longer names (it's actually allocator-dependent), it will cause all existing pointers to the old object to become dangling, as they now point to freed memory. Fix the issue by renaming to a more descriptive name, and pass a pointer to the actual reference that can safely be invalidated if the realloc succeeds.
| * | branch: clarify documentation around branchesEtienne Samson2019-12-071-27/+31
| | |
* | | Merge pull request #5333 from lrm29/attr_binary_macroPatrick Steinhardt2019-12-131-1/+1
|\ \ \ | | | | | | | | attr: Update definition of binary macro
| * | | attr: Update definition of binary macroLaurence McGlashan2019-12-121-1/+1
| |/ /
* | | path: support non-ascii drive letters on dosEdward Thomson2019-12-101-8/+30
| | | | | | | | | | | | | | | | | | | | | Windows/DOS only supports drive letters that are alpha characters A-Z. However, you can `subst` any one-character as a drive letter, including numbers or even emoji. Test that we can identify emoji as drive letters.
* | | path: protect NTFS everywhereEdward Thomson2019-12-103-8/+4
| | | | | | | | | | | | | | | Enable core.protectNTFS by default everywhere and in every codepath, not just on checkout.
* | | path: rename function that detects end of filenameEdward Thomson2019-12-101-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function `only_spaces_and_dots` used to detect the end of the filename on win32. Now we look at spaces and dots _before_ the end of the string _or_ a `:` character, which would signify a win32 alternate data stream. Thus, rename the function `ntfs_end_of_filename` to indicate that it detects the (virtual) end of a filename, that any further characters would be elided to the given path.
* | | path: also guard `.gitmodules` against NTFS Alternate Data StreamsJohannes Schindelin2019-12-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We just safe-guarded `.git` against NTFS Alternate Data Stream-related attack vectors, and now it is time to do the same for `.gitmodules`. Note: In the added regression test, we refrain from verifying all kinds of variations between short names and NTFS Alternate Data Streams: as the new code disallows _all_ Alternate Data Streams of `.gitmodules`, it is enough to test one in order to know that all of them are guarded against. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
* | | Disallow NTFS Alternate Data Stream attacks, even on Linux/macOSJohannes Schindelin2019-12-101-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A little-known feature of NTFS is that it offers to store metadata in so-called "Alternate Data Streams" (inspired by Apple's "resource forks") that are copied together with the file they are associated with. These Alternate Data Streams can be accessed via `<file name>:<stream name>:<stream type>`. Directories, too, have Alternate Data Streams, and they even have a default stream type `$INDEX_ALLOCATION`. Which means that `abc/` and `abc::$INDEX_ALLOCATION/` are actually equivalent. This is of course another attack vector on the Git directory that we definitely want to prevent. On Windows, we already do this incidentally, by disallowing colons in file/directory names. While it looks as if files'/directories' Alternate Data Streams are not accessible in the Windows Subsystem for Linux, and neither via CIFS/SMB-mounted network shares in Linux, it _is_ possible to access them on SMB-mounted network shares on macOS. Therefore, let's go the extra mile and prevent this particular attack _everywhere_. To keep things simple, let's just disallow *any* Alternate Data Stream of `.git`. This is libgit2's variant of CVE-2019-1352. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
View Lorry Controller Status