From: Joe Ranieri Date: Mon, 18 Feb 2019 14:09:56 GMT Subject: Re: [BUG] ls-files showing deleted files (unchecked lstat return value) Message-ID: <6588ca4f-7ecb-748a-ded5-f9bd014700c4@grammatech.com> In-Reply-To: <000001d4c6d9$bceb5810$36c20830$@nexbridge.com> On 2/17/19 10:59, Randall S. Becker wrote: > On February 17, 2019 8:50, Joe Ranieri wrote: >> "git ls-files -m" can show deleted files, despite -d not having been specified. >> This is due to ls-files.c's show_files function calling lstat but not checking the >> return value before calling ie_modified with the uninitialized stat structure. > > What version of git are you looking scanning? Commit 8989e1950a (2.21.0-rc1) has the following: The analysis was performed on an old version of git, but I examined the code manually (commit 7589e63) to verify the code hadn't meaningfully changed. > err = lstat(fullname.buf, &st); > if (show_deleted && err) > ... > > You may be correct that the following check: > if (show_modified && ie_modified(repo->index, ce, &st, 0 > > may need to include !err. Is that your conclusion? Is there a test case you have to demonstrate this that I can include in the test suite? Yes, this is the line I was referring to and the change I would have suggested. I don't have an automated test case, though I was able to replicate it by deleting a file on disk and running "git ls-files -m". -- Thanks and Regards, Joe Ranieri Software Engineer GrammaTech, Inc.