[pull] master from git:master#236
Merged
Merged
Conversation
With b4 0.15.2, I hit a local failure after sending a series with the in-tree cover template. The generated sent/<change-id>-vN tag contained base-commit, but did not contain change-id, and later b4 commands failed when trying to read it: CRITICAL: Tag sent/... does not contain change-id info Looking at b4's source, the sent tag message is derived from the rendered cover letter. The same code later parses that tag and expects both base-commit and change-id to be present. The default b4 cover template has both trailers, but our in-tree template only has base-commit. Add the missing change-id trailer next to base-commit so sent tags produced from the project template remain readable by b4's reroll and comparison logic. Signed-off-by: Chen Linxuan <me@black-desk.cn> Acked-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
In 10a6762 (object-file: adapt `stream_object_signature()` to take a stream, 2026-02-23), we have refactored `stream_object_signature()` so that it doesn't create the stream ad-hoc anymore. Instead, callers are expected to pass in a stream, which allows them to construct the streams from different sources. While the stream was previously managed by `stream_object_signature()`, the full lifecycle is now owned by the caller. Hence, it's the caller's responsibility to close the stream, and the called function shouldn't do that anymore. And while the mentioned commit did drop one call that closed the stream, there's a second such call that was missed when reading from the stream fails. The consequence of this can be a double free of the stream. Fix the bug by dropping that leftover call to `odb_read_stream_close()`. Note that it was originally discussed whether this should be treated as a security vulnerability. But there are only two callers: once via `parse_object_with_flags()`, and once via `verify_packfile()`. Neither of these callers plays any role on the transport layer, so this issue is only relevant for objects that are already available via the local object database. Furthermore, a packfile that is corrupted in this way would be detected when receiving the packfile, so it's not easy for an adversary to plant such a packfile, either. Consequently, we decided that this is not covered as part of our threat model. Reported-by: xuqing yang <rigelyoung@icloud.com> Helped-by: Jeff King <peff@peff.net> Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
The stream-based object signature verification path has been corrected to avoid double-closing the stream on read errors. * ps/odb-stream-double-close-fix: object-file: fix closing object stream twice
The in-tree 'b4' cover letter template has been updated to include the 'change-id' trailer, ensuring that sent tags generated by 'b4' contain the required tracking information for subsequent runs. * cl/b4-cover-change-id: b4: include change-id in cover template
Signed-off-by: Junio C Hamano <gitster@pobox.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )