verify_signed_buffer: use tempfile object
We use git_mkstemp to create a temporary file, and try to clean it up in all exit paths from the function. But that misses any cases where we die by signal, or by calling die() in a sub-function. In addition, we missed one of the exit paths. Let's convert to using a tempfile object, which handles the hard cases for us, and add the missing cleanup call. Note that we would not simply want to rely on program exit to catch our missed cleanup, as this function may be called many times in a single program (for the same reason, we use a static tempfile instead of heap-allocating a new one; that gives an upper bound on our memory usage). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Jeff King committed
Jun 17, 2016 at 19:38 UTC
4322353bfb53a83e6657af50603d3521ee9d7d0c
1 file changed
+13
-8
gpg-interface.c
+13
-8
@@ -3,6 +3,7 @@
3
#include "strbuf.h"
4
#include "gpg-interface.h"
5
#include "sigchain.h"
6
+#include "tempfile.h"
7
8
static char *configured_signing_key;
9
static const char *gpg_program = "gpg";
@@ -208,28 +209,32 @@ int verify_signed_buffer(const char *payload, size_t payload_size,
209
struct strbuf *gpg_output, struct strbuf *gpg_status)
210
{
211
struct child_process gpg = CHILD_PROCESS_INIT;
211
- char path[PATH_MAX];
212
+ static struct tempfile temp;
213
int fd, ret;
214
struct strbuf buf = STRBUF_INIT;
215
215
- fd = git_mkstemp(path, PATH_MAX, ".git_vtag_tmpXXXXXX");
216
+ fd = mks_tempfile_t(&temp, ".git_vtag_tmpXXXXXX");
217
if (fd < 0)
217
- return error_errno(_("could not create temporary file '%s'"), path);
218
- if (write_in_full(fd, signature, signature_size) < 0)
219
- return error_errno(_("failed writing detached signature to '%s'"), path);
218
+ return error_errno(_("could not create temporary file"));
219
+ if (write_in_full(fd, signature, signature_size) < 0) {
220
+ error_errno(_("failed writing detached signature to '%s'"),
221
+ temp.filename.buf);
222
+ delete_tempfile(&temp);
223
+ return -1;
224
+ }
225
close(fd);
226
227
argv_array_pushl(&gpg.args,
228
gpg_program,
229
"--status-fd=1",
225
- "--verify", path, "-",
230
+ "--verify", temp.filename.buf, "-",
231
NULL);
232
gpg.in = -1;
233
gpg.out = -1;
234
if (gpg_output)
235
gpg.err = -1;
236
if (start_command(&gpg)) {
232
- unlink(path);
237
+ delete_tempfile(&temp);
238
return error(_("could not run gpg."));
239
}
240
@@ -249,7 +254,7 @@ int verify_signed_buffer(const char *payload, size_t payload_size,
254
ret = finish_command(&gpg);
255
sigchain_pop(SIGPIPE);
256
252
- unlink_or_warn(path);
257
+ delete_tempfile(&temp);
258
259
ret |= !strstr(gpg_status->buf, "\n[GNUPG:] GOODSIG ");
260
strbuf_release(&buf); /* no matter it was used or not */