refs: strip out not allowed flags from ref_transaction_update

Callers are only allowed to pass certain flags into ref_transaction_update, other flags are internal to it. To prevent mistakes from the callers, strip the internal only flags out before continuing. This was noticed because of a compiler warning gcc 7.1.1 issued about passing a NULL parameter as second parameter to memcpy (through hashcpy): In file included from refs.c:5:0: refs.c: In function ‘ref_transaction_verify’: cache.h:948:2: error: argument 2 null where non-null expected [-Werror=nonnull] memcpy(sha_dst, sha_src, GIT_SHA1_RAWSZ); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from git-compat-util.h:165:0, from cache.h:4, from refs.c:5: /usr/include/string.h:43:14: note: in a call to function ‘memcpy’ declared here extern void *memcpy (void *__restrict __dest, const void *__restrict __src, ^~~~~~ The call to hascpy in ref_transaction_add_update is protected by the passed in flags, but as we only add flags there, gcc notices REF_HAVE_NEW or REF_HAVE_OLD flags could be passed in from the outside, which would potentially result in passing in NULL as second parameter to memcpy. Fix both the compiler warning, and make the interface safer for its users by stripping the internal flags out. Suggested-by: Michael Haggerty <mhagger@alum.mit.edu> Signed-off-by: Thomas Gummerer <t.gummerer@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Thomas Gummerer committed Sep 12, 2017 at 23:59 UTC c788c54cde5f7d52e4db9d4971545c3b2456ddcf
2 files changed +10
refs.c
+2
@@ -921,6 +921,8 @@ int ref_transaction_update(struct ref_transaction *transaction,
921 return -1;
922 }
923
924 + flags &= REF_TRANSACTION_UPDATE_ALLOWED_FLAGS;
925 +
926 flags |= (new_sha1 ? REF_HAVE_NEW : 0) | (old_sha1 ? REF_HAVE_OLD : 0);
927
928 ref_transaction_add_update(transaction, refname, flags,
refs.h
+8
@@ -354,6 +354,14 @@ int refs_pack_refs(struct ref_store *refs, unsigned int flags);
354 #define REF_NODEREF 0x01
355 #define REF_FORCE_CREATE_REFLOG 0x40
356
357 +/*
358 + * Flags that can be passed in to ref_transaction_update
359 + */
360 +#define REF_TRANSACTION_UPDATE_ALLOWED_FLAGS \
361 + REF_ISPRUNING | \
362 + REF_FORCE_CREATE_REFLOG | \
363 + REF_NODEREF
364 +
365 /*
366 * Setup reflog before using. Fill in err and return -1 on failure.
367 */