kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

Merge branch 'pw/sparse-cache-tree-verify-fix' 

Recent sparse-index addition, namely any use of index_name_pos(),
can expand sparse index entries and breaks any code that walks
cache-tree or existing index entries.  One such instance of such a
breakage has been corrected.

* pw/sparse-cache-tree-verify-fix:
  t1092: run "rebase --apply" without "-q" in testing
  sparse index: fix use-after-free bug in cache_tree_verify()
maint
Junio C Hamano 2021-10-25 16:06:57 -07:00
parent 2c428e4205 5e311edfd3
commit e058b1846c
2 changed files with 30 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
cache-tree.c
View File

@ -827,10 +827,17 @@ static void verify_one_sparse(struct repository *r,
path->buf);
}

static void verify_one(struct repository *r,
struct index_state *istate,
struct cache_tree *it,
struct strbuf *path)
/*
* Returns:
* 0 - Verification completed.
* 1 - Restart verification - a call to ensure_full_index() freed the cache
* tree that is being verified and verification needs to be restarted from
* the new toplevel cache tree.
*/
static int verify_one(struct repository *r,
struct index_state *istate,
struct cache_tree *it,
struct strbuf *path)
{
int i, pos, len = path->len;
struct strbuf tree_buf = STRBUF_INIT;
@ -838,21 +845,30 @@ static void verify_one(struct repository *r,

for (i = 0; i < it->subtree_nr; i++) {
strbuf_addf(path, "%s/", it->down[i]->name);
verify_one(r, istate, it->down[i]->cache_tree, path);
if (verify_one(r, istate, it->down[i]->cache_tree, path))
return 1;
strbuf_setlen(path, len);
}

if (it->entry_count < 0 ||
/* no verification on tests (t7003) that replace trees */
lookup_replace_object(r, &it->oid) != &it->oid)
return;
return 0;

if (path->len) {
/*
* If the index is sparse and the cache tree is not
* index_name_pos() may trigger ensure_full_index() which will
* free the tree that is being verified.
*/
int is_sparse = istate->sparse_index;
pos = index_name_pos(istate, path->buf, path->len);
if (is_sparse && !istate->sparse_index)
return 1;

if (pos >= 0) {
verify_one_sparse(r, istate, it, path, pos);
return;
return 0;
}

pos = -pos - 1;
@ -900,6 +916,7 @@ static void verify_one(struct repository *r,
oid_to_hex(&new_oid), oid_to_hex(&it->oid));
strbuf_setlen(path, len);
strbuf_release(&tree_buf);
return 0;
}

void cache_tree_verify(struct repository *r, struct index_state *istate)
@ -908,6 +925,10 @@ void cache_tree_verify(struct repository *r, struct index_state *istate)

if (!istate->cache_tree)
return;
verify_one(r, istate, istate->cache_tree, &path);
if (verify_one(r, istate, istate->cache_tree, &path)) {
strbuf_reset(&path);
if (verify_one(r, istate, istate->cache_tree, &path))
BUG("ensure_full_index() called twice while verifying cache tree");
}
strbuf_release(&path);
}

2
t/t1092-sparse-checkout-compatibility.sh
View File

@ -514,7 +514,7 @@ test_expect_success 'checkout and reset (mixed) [sparse]' '
test_expect_success 'merge, cherry-pick, and rebase' '
init_repos &&

for OPERATION in "merge -m merge" cherry-pick rebase
for OPERATION in "merge -m merge" cherry-pick "rebase --apply" "rebase --merge"
do
test_all_match git checkout -B temp update-deep &&
test_all_match git $OPERATION update-folder1 &&