threads / patch / 39272

patchbundle: verify arguments more strictly

Subject: [PATCH] bundle: verify arguments more strictly

## tl;dr

4 messages between May 8, 2015 and May 8, 2015. Diffs are folded; open one to read it.

replies: 3people: 2as markdown or json

Patrick Steinhardt· May 8, 2015, 07:49 UTC · lore
The `verify` and `create` subcommands of the bundle builtin do
not properly verify the command line arguments that have been
passed in. While the `verify` subcommand accepts an arbitrary
amount of ignored arguments the `create` subcommand does not
complain about being passed too few arguments, resulting in a
bogus call to `git rev-list`. Fix these errors by verifying that
the correct amount of arguments has been passed in.
---
 builtin/bundle.c | 8 ++++++++
 1 file changed, 8 insertions(+)
Show changes to builtin/bundle.c +8 −0
diff --git a/builtin/bundle.c b/builtin/bundle.c
index 92a8a60..4883a43 100644
--- a/builtin/bundle.c
+++ b/builtin/bundle.c
@@ -42,6 +42,10 @@ int cmd_bundle(int argc, const char **argv, const char *prefix)
 
 	if (!strcmp(cmd, "verify")) {
 		close(bundle_fd);
+		if (argc != 1) {
+			usage(builtin_bundle_usage);
+			return 1;
+		}
 		if (verify_bundle(&header, 1))
 			return 1;
 		fprintf(stderr, _("%s is okay\n"), bundle_file);
@@ -52,6 +56,10 @@ int cmd_bundle(int argc, const char **argv, const char *prefix)
 		return !!list_bundle_refs(&header, argc, argv);
 	}
 	if (!strcmp(cmd, "create")) {
+		if (argc < 2) {
+			usage(builtin_bundle_usage);
+			return 1;
+		}
 		if (!startup_info->have_repository)
 			die(_("Need a repository to create a bundle."));
 		return !!create_bundle(&header, bundle_file, argc, argv);
-- 
2.4.0
Patrick Steinhardt· May 8, 2015, 08:02 UTC · re: Patrick Steinhardt · lore

[PATCH v2] bundle: verify arguments more strictly

The `verify` and `create` subcommands of the bundle builtin do not properly verify the command line arguments that have been passed in. While the `verify` subcommand accepts an arbitrary amount of ignored arguments the `create` subcommand does not complain about being passed too few arguments, resulting in a bogus call to `git rev-list`. Fix these errors by verifying that the correct amount of arguments has been passed in.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
---
Added missing Signed-off-by.
 builtin/bundle.c | 8 ++++++++
 1 file changed, 8 insertions(+)
Show changes to builtin/bundle.c +8 −0
diff --git a/builtin/bundle.c b/builtin/bundle.c
index 92a8a60..4883a43 100644
--- a/builtin/bundle.c
+++ b/builtin/bundle.c
@@ -42,6 +42,10 @@ int cmd_bundle(int argc, const char **argv, const char *prefix)
 
 	if (!strcmp(cmd, "verify")) {
 		close(bundle_fd);
+		if (argc != 1) {
+			usage(builtin_bundle_usage);
+			return 1;
+		}
 		if (verify_bundle(&header, 1))
 			return 1;
 		fprintf(stderr, _("%s is okay\n"), bundle_file);
@@ -52,6 +56,10 @@ int cmd_bundle(int argc, const char **argv, const char *prefix)
 		return !!list_bundle_refs(&header, argc, argv);
 	}
 	if (!strcmp(cmd, "create")) {
+		if (argc < 2) {
+			usage(builtin_bundle_usage);
+			return 1;
+		}
 		if (!startup_info->have_repository)
 			die(_("Need a repository to create a bundle."));
 		return !!create_bundle(&header, bundle_file, argc, argv);
-- 
2.4.0
Johannes Schindelin· May 8, 2015, 08:11 UTC · re: Patrick Steinhardt · lore

Re: [PATCH] bundle: verify arguments more strictly

Hi Patrick,
On 2015-05-08 09:49, Patrick Steinhardt wrote:
Show 7 quoted lines
> The `verify` and `create` subcommands of the bundle builtin do
> not properly verify the command line arguments that have been
> passed in. While the `verify` subcommand accepts an arbitrary
> amount of ignored arguments the `create` subcommand does not
> complain about being passed too few arguments, resulting in a
> bogus call to `git rev-list`. Fix these errors by verifying that
> the correct amount of arguments has been passed in.
Good catch. But please sign off your patch [*1*]
Other than that...
Acked-by: Johannes Schindelin <johannes.schindelin@gmx.de>

Ciao, Johannes

Footnote *1*: Here is why you need to sign off on your patches: https://github.com/git/git/blob/v2.3.5/Documentation/SubmittingPatches#L234-L286

← back to recent threads