git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH v3 2/4] apply: do not read from the filesystem under --index

From
Junio C Hamano <gitster@pobox.com>
Date
Feb 4, 2015, 00:44 UTC
Message-ID
<1423010662-26497-3-git-send-email-gitster@pobox.com>
In-Reply-To
<1423010662-26497-1-git-send-email-gitster@pobox.com>

We currently read the preimage to apply a patch from the index only when the --cached option is given. Do so also when the command is running under the --index option. With --index, the index entry and the working tree file for a path that is involved in a patch must be identical, so this should not affect the result, but by reading from the index, we will get the protection to avoid reading an unintended path beyond a symbolic link automatically.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 * Same as v2
 builtin/apply.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/builtin/apply.c b/builtin/apply.c
index c751ddf..05eaf54 100644
--- a/builtin/apply.c
+++ b/builtin/apply.c
@@ -3136,7 +3136,7 @@ static int load_patch_target(struct strbuf *buf,
 			     const char *name,
 			     unsigned expected_mode)
 {
-	if (cached) {
+	if (cached || check_index) {
 		if (read_file_or_gitlink(ce, buf))
 			return error(_("read of %s failed"), name);
 	} else if (name) {
-- 
2.3.0-rc2-168-g106c876
Previous: Junio C HamanoNext: Junio C Hamano
Message 27 of 34 in “"git apply" safety”
  1. 0/4 "git apply" safetyJunio C Hamano, Feb 2, 2015
  2. 1/4 apply: reject input that touches outside $cwdJunio C Hamano, Feb 2, 2015
  3. Jeff KingFeb 3, 2015
  4. Jeff KingFeb 3, 2015
  5. Junio C HamanoFeb 3, 2015
  6. Jeff KingFeb 3, 2015
  7. Junio C HamanoFeb 3, 2015
  8. Jeff KingFeb 3, 2015
  9. Junio C HamanoFeb 3, 2015
  10. Jeff KingFeb 3, 2015
  11. Junio C HamanoFeb 3, 2015
  12. Torsten BögershausenFeb 3, 2015
  13. 2/4 apply: do not read from the filesystem under --indexJunio C Hamano, Feb 2, 2015
  14. 3/4 apply: do not read from beyond a symbolic linkJunio C Hamano, Feb 2, 2015
  15. Stefan BellerFeb 3, 2015
  16. Junio C HamanoFeb 3, 2015
  17. Stefan BellerFeb 3, 2015
  18. Junio C HamanoFeb 3, 2015
  19. 4/4 apply: do not touch a file beyond a symbolic linkJunio C Hamano, Feb 2, 2015
  20. Jeff KingFeb 3, 2015
  21. Junio C HamanoFeb 3, 2015
  22. Jeff KingFeb 3, 2015
  23. Junio C HamanoFeb 3, 2015
  24. Eric SunshineFeb 3, 2015
  25. 0/4 "git apply" safetyJunio C Hamano, Feb 4, 2015
  26. 1/4 apply: reject input that touches outside the working areaJunio C Hamano, Feb 4, 2015
  27. 2/4 apply: do not read from the filesystem under --indexJunio C Hamano, Feb 4, 2015
  28. 3/4 apply: do not read from beyond a symbolic linkJunio C Hamano, Feb 4, 2015
  29. 4/4 apply: do not touch a file beyond a symbolic linkJunio C Hamano, Feb 4, 2015
  30. 0/4 "git apply" safetyJunio C Hamano, Feb 10, 2015
  31. 1/4 apply: reject input that touches outside the working areaJunio C Hamano, Feb 10, 2015
  32. 2/4 apply: do not read from the filesystem under --indexJunio C Hamano, Feb 10, 2015
  33. 3/4 apply: do not read from beyond a symbolic linkJunio C Hamano, Feb 10, 2015
  34. 4/4 apply: do not touch a file beyond a symbolic linkJunio C Hamano, Feb 10, 2015

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.