[BUG] commit walk machinery is dangerous !

From: Nicolas Pitre <nico@cam.org>
Date: Jul 14, 2008, 20:54 UTC
Message-ID: <alpine.LFD.1.10.0807141641110.12484@xanadu.home>

Good!  I have all your attention now.

Yes, I'm kinda fscking upset about my hardware at this moment. I apparently have git packs corrupting themselves from time to time which prompted me to make git more robust against some kind of corruptions recently.

However this time a corruption turned up and exposed what I think is a major flaw in git's error checking. To demonstrate it, I created the following test case. Turning the error() into a die() on line 772 of commit.c makes this test pass but I don't know if this is the appropriate fix (e.g. some attempt to parse non existing commits could be valid usage, etc.). Note this is critical only for git versions later than commit 8eca0b47ff15.

So here's the test. The catastrophic consequences that this can have on one's repository is left as an exercise to the reader.

diff --git a/t/t6011-rev-list-with-bad-commit.sh b/t/t6011-rev-list-with-bad-commit.sh
new file mode 100755
index 0000000..a5fe190
--- /dev/null
+++ b/t/t6011-rev-list-with-bad-commit.sh
@@ -0,0 +1,60 @@
+#!/bin/sh
+
+test_description='git rev-list should notice bad commits'
+
+. ./test-lib.sh
+
+# Note:
+# - compression level is set to zero to make "corruptions" easier to perform
+# - reflog is disabled to avoid extra references which would twart the test
+
+test_expect_success 'setup' \
+   '
+   git init &&
+   git config core.compression 0 &&
+   git config core.logallrefupdates false &&
+   echo "foo" > foo &&
+   git add foo &&
+   git commit -m "first commit" &&
+   echo "bar" > bar &&
+   git add bar &&
+   git commit -m "second commit" &&
+   echo "baz" > baz &&
+   git add baz &&
+   git commit -m "third commit" &&
+   echo "foo again" >> foo &&
+   git add foo &&
+   git commit -m "fourth commit" &&
+   git repack -a -f -d
+   '
+
+test_expect_success 'verify number of revisions' \
+   '
+   revs=$(git rev-list --all | wc -l) &&
+   test $revs -eq 4 &&
+   first_commit=$(git rev-parse HEAD~3)
+   '
+
+test_expect_success 'corrupt second commit object' \
+   '
+   perl -i.bak -pe "s/second commit/socond commit/" .git/objects/pack/*.pack &&
+   test_must_fail git fsck --all
+   '
+
+test_expect_success 'rev-list should fail' \
+   '
+   test_must_fail git rev-list --all > /dev/null
+   '
+
+test_expect_success 'git repack _MUST_ fail' \
+   '
+   test_must_fail git repack -a -f -d
+   '
+
+test_expect_success 'first commit is still available' \
+   '
+   git log $first_commit
+   '
+
+test_done
+