git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] Fix "unpack-objects --strict"

From
MKMartin Koegler <mkoegler@auto.tuwien.ac.at>
Date
Aug 14, 2009, 07:19 UTC
Message-ID
<20090814071949.GA2342@auto.tuwien.ac.at>
In-Reply-To
<7vocqiucpw.fsf@alter.siamese.dyndns.org>
On Thu, Aug 13, 2009 at 11:32:59PM -0700, Junio C Hamano wrote:
Show 13 quoted lines
> Martin Koegler <mkoegler@auto.tuwien.ac.at> writes:
> > To introduce a object with one of its linked objects missing, left it
> > out of the pack and push it into the repository. unpack-objects will
> > unpack all objects and fail updating the ref (but leave all objects in
> > the repository). As second step, simply send a ref update request,
> > which should succed, as the object is present in the repository.
> 
> Your "ref update request" exploit does not work because your understanding
> of how we decide to allow updating a ref is flawed.
> 
> We do not blindly update a ref to a commit only because we happen to have
> that commit.  We require that commit to reach existing tips of refs
> without break.  The logic is in quickfetch() in builtin-fetch.c.

I'm talking on the server side of a push operation (receive-pack), not the client side. The patchset should prevent invalid data from entering the repository, thereby preventing upload-pack (during further fetch operation) and other git programs (eg. called from gitweb) from failing/segfaulting.

mfg Martin Kögler
Previous: Junio C HamanoNext: Junio C Hamano
Message 6 of 9 in “[BUG] Submodules problem with subdirectories and pushing”
  1. Frank LichtenheldAug 13, 2009
  2. Frank LichtenheldAug 13, 2009
  3. Fix "unpack-objects --strict"Junio C Hamano, Aug 13, 2009
  4. Martin KoeglerAug 14, 2009
  5. Junio C HamanoAug 14, 2009
  6. Martin KoeglerAug 14, 2009
  7. Junio C HamanoAug 14, 2009
  8. Junio C HamanoAug 14, 2009
  9. Frank LichtenheldAug 14, 2009

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.