Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-28 Thread Junio C Hamano
Jeff King writes: > So the patch: > >> > diff --git a/fetch-pack.c b/fetch-pack.c >>... > is a wrong direction, I think. It removes the extra safety check that > skips the ref above. But worse, in the example above, it overwrites the > real object "1234..." with the name of the ref "abcd..." in t

Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Jeff King
On Sat, Feb 27, 2016 at 05:28:55PM -0300, Gabriel Souza Franco wrote: > On Sat, Feb 27, 2016 at 4:19 PM, Jeff King wrote: > > On Sat, Feb 27, 2016 at 02:07:12PM -0500, Jeff King wrote: > > > >> We expect whoever creates the "sought" list to fill in the name and sha1 > >> as appropriate. If that i

Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Gabriel Souza Franco
On Sat, Feb 27, 2016 at 4:19 PM, Jeff King wrote: > On Sat, Feb 27, 2016 at 02:07:12PM -0500, Jeff King wrote: > >> We expect whoever creates the "sought" list to fill in the name and sha1 >> as appropriate. If that is not happening in some code path, then yeah, >> filter_refs() will not work as i

Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Jeff King
On Sat, Feb 27, 2016 at 02:07:12PM -0500, Jeff King wrote: > We expect whoever creates the "sought" list to fill in the name and sha1 > as appropriate. If that is not happening in some code path, then yeah, > filter_refs() will not work as intended. But I think the solution there > would be to fix

Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Jeff King
On Sat, Feb 27, 2016 at 10:25:40AM -0800, Junio C Hamano wrote: > Gabriel Souza Franco writes: > > > Check was introduced in b791642 (filter_ref: avoid overwriting > > ref->old_sha1 with garbage, 2015-03-19), but was always false because > > ref->old_oid.hash is empty in this case. Instead copy

Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Junio C Hamano
Junio C Hamano writes: > Nah, I think you just misspelt hashcpy() as hashcmp(). The original > wanted to get the binary representation of the hex in old_sha1 when > it continued, and you wanted to delay the touching of old_sha1 until > we make sure that the input is valid 40-hex. That much was

Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Junio C Hamano
Junio C Hamano writes: > Gabriel Souza Franco writes: > >> Check was introduced in b791642 (filter_ref: avoid overwriting >> ref->old_sha1 with garbage, 2015-03-19), but was always false because >> ref->old_oid.hash is empty in this case. Instead copy sha1 from ref->name. >> >> Signed-off-by: Ga

Re: [PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Junio C Hamano
Gabriel Souza Franco writes: > Check was introduced in b791642 (filter_ref: avoid overwriting > ref->old_sha1 with garbage, 2015-03-19), but was always false because > ref->old_oid.hash is empty in this case. Instead copy sha1 from ref->name. > > Signed-off-by: Gabriel Souza Franco > --- Peff,

[PATCH] fetch-pack: fix unadvertised requests validation

2016-02-27 Thread Gabriel Souza Franco
Check was introduced in b791642 (filter_ref: avoid overwriting ref->old_sha1 with garbage, 2015-03-19), but was always false because ref->old_oid.hash is empty in this case. Instead copy sha1 from ref->name. Signed-off-by: Gabriel Souza Franco --- fetch-pack.c | 4 ++-- 1 file changed, 2 inserti