Re: [PATCH] Fix "unpack-objects --strict"
- From
- Martin Koegler <mkoegler@auto.tuwien.ac.at>
- Date
- Aug 14, 2009, 07:19 UTC
- Message-ID
- <20090814071949.GA2342@auto.tuwien.ac.at>
- In-Reply-To
- <7vocqiucpw.fsf@alter.siamese.dyndns.org>
On Thu, Aug 13, 2009 at 11:32:59PM -0700, Junio C Hamano wrote:
Show 13 quoted lines
> Martin Koegler <mkoegler@auto.tuwien.ac.at> writes: > > To introduce a object with one of its linked objects missing, left it > > out of the pack and push it into the repository. unpack-objects will > > unpack all objects and fail updating the ref (but leave all objects in > > the repository). As second step, simply send a ref update request, > > which should succed, as the object is present in the repository. > > Your "ref update request" exploit does not work because your understanding > of how we decide to allow updating a ref is flawed. > > We do not blindly update a ref to a commit only because we happen to have > that commit. We require that commit to reach existing tips of refs > without break. The logic is in quickfetch() in builtin-fetch.c.
I'm talking on the server side of a push operation (receive-pack), not the client side. The patchset should prevent invalid data from entering the repository, thereby preventing upload-pack (during further fetch operation) and other git programs (eg. called from gitweb) from failing/segfaulting.
mfg Martin Kögler