Subject: Re: [PATCH 0/1] quote: quote space

From: Junio C Hamano <[email-masked]>
Date: Tue, 26 Mar 2024 14:41:45 -0700

This patch hasn't seen any review, which is understandable because
it was buried in another patch'es discussion thread.

I'll give it a read-over once again, as self-reviews are better than
no reviews at all ;-) and then would mark it for 'next' if I didn't
find anything.

> ----- >8 --------- >8 --------- >8 --------- >8 -----
> Subject: [PATCH] apply: parse names out of "diff --git" more carefully
>
> "git apply" uses the pathname parsed out of the "diff --git" header
> to decide which path is being patched, but this is used only when
> there is no other names available in the patch.  When there is any
> content change (like we can see in this patch, that modifies the
> contents of "apply.c") or rename (which comes with "rename from" and
> "rename to" extended diff headers), the names are available without
> having to parse this header.
>
> When we do need to parse this header, a special care needs to be
> taken, as the name of a directory or a file can have a SP in it so
> it is not like "find a space, and take everything before the space
> and that is the preimage filename, everything after the space is the
> postimage filename".  We have a loop that stops at every SP on the
> "diff --git a/dir/file b/dir/foo" line and see if that SP is the
> right place that separates such a pair of names.
>
> Unfortunately, this loop can terminate prematurely when a crafted
> directory name ended with a SP.  The next pathname component after
> that SP (i.e. the beginning of the possible postimage filename) will
> be a slash, and instead of rejecting that position as the valid
> separation point between pre- and post-image filenames and keep
> looping, we stopped processing right there.
>
> The fix is simple.  Instead of stopping and giving up, keep going on
> when we see such a condition.
>
> Reported-by: Han Young <[email-masked]>
> Signed-off-by: Junio C Hamano <[email-masked]>
> ---
>  apply.c                |  9 ++++++++-
>  t/t4126-apply-empty.sh | 22 ++++++++++++++++++++++
>  2 files changed, 30 insertions(+), 1 deletion(-)
>
> diff --git c/apply.c w/apply.c
> index 432837a674..e311013bc4 100644
> --- c/apply.c
> +++ w/apply.c
> @@ -1292,8 +1292,15 @@ static char *git_header_name(int p_value,
>  				return NULL; /* no postimage name */
>  			second = skip_tree_prefix(p_value, name + len + 1,
>  						  line_len - (len + 1));
> +			/*
> +			 * If we are at the SP at the end of a directory,
> +			 * skip_tree_prefix() may return NULL as that makes
> +			 * it appears as if we have an absolute path.
> +			 * Keep going to find another SP.
> +			 */
>  			if (!second)
> -				return NULL;
> +				continue;
> +
>  			/*
>  			 * Does len bytes starting at "name" and "second"
>  			 * (that are separated by one HT or SP we just
> diff --git c/t/t4126-apply-empty.sh w/t/t4126-apply-empty.sh
> index ece9fae207..eaf0c5304a 100755
> --- c/t/t4126-apply-empty.sh
> +++ w/t/t4126-apply-empty.sh
> @@ -66,4 +66,26 @@ test_expect_success 'apply --index create' '
>  	git diff --exit-code
>  '
>  
> +test_expect_success 'apply with no-contents and a funny pathname' '
> +	mkdir "funny " &&
> +	>"funny /empty" &&
> +	git add "funny /empty" &&
> +	git diff HEAD "funny /" >sample.patch &&
> +	git diff -R HEAD "funny /" >elpmas.patch &&
> +	git reset --hard &&
> +	rm -fr "funny " &&
> +
> +	git apply --stat --check --apply sample.patch &&
> +	test_must_be_empty "funny /empty" &&
> +
> +	git apply --stat --check --apply elpmas.patch &&
> +	test_path_is_missing "funny /empty" &&
> +
> +	git apply -R --stat --check --apply elpmas.patch &&
> +	test_must_be_empty "funny /empty" &&
> +
> +	git apply -R --stat --check --apply sample.patch &&
> +	test_path_is_missing "funny /empty"
> +'
> +
>  test_done