apply: reject input that touches outside the working area

[git.git] / sha1_file.c

diff --git a/sha1_file.c b/sha1_file.c
index 7dadd04cb75a9f681cab17f616600cf437fe82ba..06c809aeeb3a608c09247b4f2146eb246938d6bf 100644 (file)
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -807,15 +807,38 @@ void free_pack_by_name(const char *pack_name)
 static unsigned int get_max_fd_limit(void)
 {
 #ifdef RLIMIT_NOFILE
-       struct rlimit lim;
+       {
+               struct rlimit lim;
 
-       if (getrlimit(RLIMIT_NOFILE, &lim))
-               die_errno("cannot get RLIMIT_NOFILE");
+               if (!getrlimit(RLIMIT_NOFILE, &lim))
+                       return lim.rlim_cur;
+       }
+#endif
 
-       return lim.rlim_cur;
-#elif defined(_SC_OPEN_MAX)
-       return sysconf(_SC_OPEN_MAX);
-#elif defined(OPEN_MAX)
+#ifdef _SC_OPEN_MAX
+       {
+               long open_max = sysconf(_SC_OPEN_MAX);
+               if (0 < open_max)
+                       return open_max;
+               /*
+                * Otherwise, we got -1 for one of the two
+                * reasons:
+                *
+                * (1) sysconf() did not understand _SC_OPEN_MAX
+                *     and signaled an error with -1; or
+                * (2) sysconf() said there is no limit.
+                *
+                * We _could_ clear errno before calling sysconf() to
+                * tell these two cases apart and return a huge number
+                * in the latter case to let the caller cap it to a
+                * value that is not so selfish, but letting the
+                * fallback OPEN_MAX codepath take care of these cases
+                * is a lot simpler.
+                */
+       }
+#endif
+
+#ifdef OPEN_MAX
        return OPEN_MAX;
 #else
        return 1; /* see the caller ;-) */
@@ -2483,15 +2506,18 @@ static int sha1_loose_object_info(const unsigned char *sha1,
 
        /*
         * If we don't care about type or size, then we don't
-        * need to look inside the object at all.
+        * need to look inside the object at all. Note that we
+        * do not optimize out the stat call, even if the
+        * caller doesn't care about the disk-size, since our
+        * return value implicitly indicates whether the
+        * object even exists.
         */
        if (!oi->typep && !oi->sizep) {
-               if (oi->disk_sizep) {
-                       struct stat st;
-                       if (stat_sha1_file(sha1, &st) < 0)
-                               return -1;
+               struct stat st;
+               if (stat_sha1_file(sha1, &st) < 0)
+                       return -1;
+               if (oi->disk_sizep)
                        *oi->disk_sizep = st.st_size;
-               }
                return 0;
        }
 
@@ -2857,7 +2883,9 @@ static int create_tmpfile(char *buffer, size_t bufsiz, const char *filename)
                /* Make sure the directory exists */
                memcpy(buffer, filename, dirlen);
                buffer[dirlen-1] = 0;
-               if (mkdir(buffer, 0777) || adjust_shared_perm(buffer))
+               if (mkdir(buffer, 0777) && errno != EEXIST)
+                       return -1;
+               if (adjust_shared_perm(buffer))
                        return -1;
 
                /* Try again */