From 91444510a56ee2bc2523c76516c0120d340fa97d Mon Sep 17 00:00:00 2001 From: Chen Linxuan Date: Fri, 10 Jul 2026 15:22:13 +0800 Subject: [PATCH 1/3] b4: include change-id in cover template With b4 0.15.2, I hit a local failure after sending a series with the in-tree cover template. The generated sent/-vN tag contained base-commit, but did not contain change-id, and later b4 commands failed when trying to read it: CRITICAL: Tag sent/... does not contain change-id info Looking at b4's source, the sent tag message is derived from the rendered cover letter. The same code later parses that tag and expects both base-commit and change-id to be present. The default b4 cover template has both trailers, but our in-tree template only has base-commit. Add the missing change-id trailer next to base-commit so sent tags produced from the project template remain readable by b4's reroll and comparison logic. Signed-off-by: Chen Linxuan Acked-by: Patrick Steinhardt Signed-off-by: Junio C Hamano --- .b4-cover-template | 1 + 1 file changed, 1 insertion(+) diff --git a/.b4-cover-template b/.b4-cover-template index ab864933b5c846..8168d8a10b3a9e 100644 --- a/.b4-cover-template +++ b/.b4-cover-template @@ -8,4 +8,5 @@ ${diffstat} ${range_diff} --- base-commit: ${base_commit} +change-id: ${change_id} ${prerequisites} From cfd52a74a0cf1a9b0e0ef6b480a45b119d8be4a2 Mon Sep 17 00:00:00 2001 From: Patrick Steinhardt Date: Fri, 10 Jul 2026 16:54:16 +0200 Subject: [PATCH 2/3] object-file: fix closing object stream twice In 10a6762719 (object-file: adapt `stream_object_signature()` to take a stream, 2026-02-23), we have refactored `stream_object_signature()` so that it doesn't create the stream ad-hoc anymore. Instead, callers are expected to pass in a stream, which allows them to construct the streams from different sources. While the stream was previously managed by `stream_object_signature()`, the full lifecycle is now owned by the caller. Hence, it's the caller's responsibility to close the stream, and the called function shouldn't do that anymore. And while the mentioned commit did drop one call that closed the stream, there's a second such call that was missed when reading from the stream fails. The consequence of this can be a double free of the stream. Fix the bug by dropping that leftover call to `odb_read_stream_close()`. Note that it was originally discussed whether this should be treated as a security vulnerability. But there are only two callers: once via `parse_object_with_flags()`, and once via `verify_packfile()`. Neither of these callers plays any role on the transport layer, so this issue is only relevant for objects that are already available via the local object database. Furthermore, a packfile that is corrupted in this way would be detected when receiving the packfile, so it's not easy for an adversary to plant such a packfile, either. Consequently, we decided that this is not covered as part of our threat model. Reported-by: xuqing yang Helped-by: Jeff King Signed-off-by: Patrick Steinhardt Signed-off-by: Junio C Hamano --- object-file.c | 5 +---- t/t1450-fsck.sh | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/object-file.c b/object-file.c index 2acc9522df2daa..610faba5b699bf 100644 --- a/object-file.c +++ b/object-file.c @@ -150,11 +150,8 @@ int stream_object_signature(struct repository *r, for (;;) { char buf[1024 * 16]; ssize_t readlen = odb_read_stream_read(st, buf, sizeof(buf)); - - if (readlen < 0) { - odb_read_stream_close(st); + if (readlen < 0) return -1; - } if (!readlen) break; git_hash_update(&c, buf, readlen); diff --git a/t/t1450-fsck.sh b/t/t1450-fsck.sh index 54e81c263686de..bc326a78f6f810 100755 --- a/t/t1450-fsck.sh +++ b/t/t1450-fsck.sh @@ -538,6 +538,23 @@ test_expect_success 'rev-list --verify-objects with bad sha1' ' test_grep -q "error: hash mismatch $(dirname $new)$(test_oid ff_2)" out ' +test_expect_success 'rev-list --verify-objects with truncated loose blob' ' + git init truncated-blob && + ( + cd truncated-blob && + blob=$(test-tool genrandom one 5k | git hash-object -t blob -w --stdin) && + obj=.git/objects/$(test_oid_to_path $blob) && + + # Truncate the loose blob such that its header can still be + # parsed, but reading the object data fails mid-stream. + test_copy_bytes 64 <"$obj" >obj.tmp && + mv obj.tmp "$obj" && + + test_must_fail git rev-list --verify-objects "$blob" 2>err && + test_grep "hash mismatch" err + ) +' + # An actual bit corruption is more likely than swapped commits, but # this provides an easy way to have commits which don't match their purported # hashes, but which aren't so broken we can't read them at all. From 5d2e7709234afea1b6ddb25cd4f60d3d5fb3c200 Mon Sep 17 00:00:00 2001 From: Junio C Hamano Date: Tue, 21 Jul 2026 10:18:29 -0700 Subject: [PATCH 3/3] The 6th batch Signed-off-by: Junio C Hamano --- Documentation/RelNotes/2.56.0.adoc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/Documentation/RelNotes/2.56.0.adoc b/Documentation/RelNotes/2.56.0.adoc index 5c6bfe1fd86a5b..9e3bf38f5e5a74 100644 --- a/Documentation/RelNotes/2.56.0.adoc +++ b/Documentation/RelNotes/2.56.0.adoc @@ -163,6 +163,10 @@ Performance, Internal Implementation, Development Support etc. dereferences and invalid file descriptor accesses flagged by Coverity. + * The in-tree 'b4' cover letter template has been updated to include the + 'change-id' trailer, ensuring that sent tags generated by 'b4' contain + the required tracking information for subsequent runs. + Fixes since v2.55 ----------------- @@ -298,3 +302,7 @@ Fixes since v2.55 split commit-graph chain, causing topological levels for commits in base layers to be recomputed during incremental writes. This has been corrected. + + * The stream-based object signature verification path has been + corrected to avoid double-closing the stream on read errors. + (merge cfd52a74a0 ps/odb-stream-double-close-fix later to maint).