wrapper.c

   1 /*
   2  * Various trivial helper wrappers around standard functions
   3  */
   4
   5 #define DISABLE_SIGN_COMPARE_WARNINGS
   6
   7 #include "git-compat-util.h"
   8 #include "abspath.h"
   9 #include "parse.h"
  10 #include "gettext.h"
  11 #include "strbuf.h"
  12 #include "trace2.h"
  13
  14 #ifdef HAVE_RTLGENRANDOM
  15 /* This is required to get access to RtlGenRandom. */
  16 #define SystemFunction036 NTAPI SystemFunction036
  17 #include <ntsecapi.h>
  18 #undef SystemFunction036
  19 #endif
  20
  21 static int memory_limit_check(size_t size, int gentle)
  22 {
  23         static size_t limit = 0;
  24         if (!limit) {
  25                 limit = git_env_ulong("GIT_ALLOC_LIMIT", 0);
  26                 if (!limit)
  27                         limit = SIZE_MAX;
  28         }
  29         if (size > limit) {
  30                 if (gentle) {
  31                         error("attempting to allocate %"PRIuMAX" over limit %"PRIuMAX,
  32                               (uintmax_t)size, (uintmax_t)limit);
  33                         return -1;
  34                 } else
  35                         die("attempting to allocate %"PRIuMAX" over limit %"PRIuMAX,
  36                             (uintmax_t)size, (uintmax_t)limit);
  37         }
  38         return 0;
  39 }
  40
  41 char *xstrdup(const char *str)
  42 {
  43         char *ret = strdup(str);
  44         if (!ret)
  45                 die("Out of memory, strdup failed");
  46         return ret;
  47 }
  48
  49 static void *do_xmalloc(size_t size, int gentle)
  50 {
  51         void *ret;
  52
  53         if (memory_limit_check(size, gentle))
  54                 return NULL;
  55         ret = malloc(size);
  56         if (!ret && !size)
  57                 ret = malloc(1);
  58         if (!ret) {
  59                 if (!gentle)
  60                         die("Out of memory, malloc failed (tried to allocate %lu bytes)",
  61                             (unsigned long)size);
  62                 else {
  63                         error("Out of memory, malloc failed (tried to allocate %lu bytes)",
  64                               (unsigned long)size);
  65                         return NULL;
  66                 }
  67         }
  68 #ifdef XMALLOC_POISON
  69         memset(ret, 0xA5, size);
  70 #endif
  71         return ret;
  72 }
  73
  74 void *xmalloc(size_t size)
  75 {
  76         return do_xmalloc(size, 0);
  77 }
  78
  79 static void *do_xmallocz(size_t size, int gentle)
  80 {
  81         void *ret;
  82         if (unsigned_add_overflows(size, 1)) {
  83                 if (gentle) {
  84                         error("Data too large to fit into virtual memory space.");
  85                         return NULL;
  86                 } else
  87                         die("Data too large to fit into virtual memory space.");
  88         }
  89         ret = do_xmalloc(size + 1, gentle);
  90         if (ret)
  91                 ((char*)ret)[size] = 0;
  92         return ret;
  93 }
  94
  95 void *xmallocz(size_t size)
  96 {
  97         return do_xmallocz(size, 0);
  98 }
  99
 100 void *xmallocz_gently(size_t size)
 101 {
 102         return do_xmallocz(size, 1);
 103 }
 104
 105 /*
 106  * xmemdupz() allocates (len + 1) bytes of memory, duplicates "len" bytes of
 107  * "data" to the allocated memory, zero terminates the allocated memory,
 108  * and returns a pointer to the allocated memory. If the allocation fails,
 109  * the program dies.
 110  */
 111 void *xmemdupz(const void *data, size_t len)
 112 {
 113         return memcpy(xmallocz(len), data, len);
 114 }
 115
 116 char *xstrndup(const char *str, size_t len)
 117 {
 118         char *p = memchr(str, '\0', len);
 119         return xmemdupz(str, p ? p - str : len);
 120 }
 121
 122 int xstrncmpz(const char *s, const char *t, size_t len)
 123 {
 124         int res = strncmp(s, t, len);
 125         if (res)
 126                 return res;
 127         return s[len] == '\0' ? 0 : 1;
 128 }
 129
 130 void *xrealloc(void *ptr, size_t size)
 131 {
 132         void *ret;
 133
 134         if (!size) {
 135                 free(ptr);
 136                 return xmalloc(0);
 137         }
 138
 139         memory_limit_check(size, 0);
 140         ret = realloc(ptr, size);
 141         if (!ret)
 142                 die("Out of memory, realloc failed");
 143         return ret;
 144 }
 145
 146 void *xcalloc(size_t nmemb, size_t size)
 147 {
 148         void *ret;
 149
 150         if (unsigned_mult_overflows(nmemb, size))
 151                 die("data too large to fit into virtual memory space");
 152
 153         memory_limit_check(size * nmemb, 0);
 154         ret = calloc(nmemb, size);
 155         if (!ret && (!nmemb || !size))
 156                 ret = calloc(1, 1);
 157         if (!ret)
 158                 die("Out of memory, calloc failed");
 159         return ret;
 160 }
 161
 162 void xsetenv(const char *name, const char *value, int overwrite)
 163 {
 164         if (setenv(name, value, overwrite))
 165                 die_errno(_("could not setenv '%s'"), name ? name : "(null)");
 166 }
 167
 168 /**
 169  * xopen() is the same as open(), but it die()s if the open() fails.
 170  */
 171 int xopen(const char *path, int oflag, ...)
 172 {
 173         mode_t mode = 0;
 174         va_list ap;
 175
 176         /*
 177          * va_arg() will have undefined behavior if the specified type is not
 178          * compatible with the argument type. Since integers are promoted to
 179          * ints, we fetch the next argument as an int, and then cast it to a
 180          * mode_t to avoid undefined behavior.
 181          */
 182         va_start(ap, oflag);
 183         if (oflag & O_CREAT)
 184                 mode = va_arg(ap, int);
 185         va_end(ap);
 186
 187         for (;;) {
 188                 int fd = open(path, oflag, mode);
 189                 if (fd >= 0)
 190                         return fd;
 191                 if (errno == EINTR)
 192                         continue;
 193
 194                 if ((oflag & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
 195                         die_errno(_("unable to create '%s'"), path);
 196                 else if ((oflag & O_RDWR) == O_RDWR)
 197                         die_errno(_("could not open '%s' for reading and writing"), path);
 198                 else if ((oflag & O_WRONLY) == O_WRONLY)
 199                         die_errno(_("could not open '%s' for writing"), path);
 200                 else
 201                         die_errno(_("could not open '%s' for reading"), path);
 202         }
 203 }
 204
 205 static int handle_nonblock(int fd, short poll_events, int err)
 206 {
 207         struct pollfd pfd;
 208
 209         if (err != EAGAIN && err != EWOULDBLOCK)
 210                 return 0;
 211
 212         pfd.fd = fd;
 213         pfd.events = poll_events;
 214
 215         /*
 216          * no need to check for errors, here;
 217          * a subsequent read/write will detect unrecoverable errors
 218          */
 219         poll(&pfd, 1, -1);
 220         return 1;
 221 }
 222
 223 /*
 224  * xread() is the same a read(), but it automatically restarts read()
 225  * operations with a recoverable error (EAGAIN and EINTR). xread()
 226  * DOES NOT GUARANTEE that "len" bytes is read even if the data is available.
 227  */
 228 ssize_t xread(int fd, void *buf, size_t len)
 229 {
 230         ssize_t nr;
 231         if (len > MAX_IO_SIZE)
 232                 len = MAX_IO_SIZE;
 233         while (1) {
 234                 nr = read(fd, buf, len);
 235                 if (nr < 0) {
 236                         if (errno == EINTR)
 237                                 continue;
 238                         if (handle_nonblock(fd, POLLIN, errno))
 239                                 continue;
 240                 }
 241                 return nr;
 242         }
 243 }
 244
 245 /*
 246  * xwrite() is the same a write(), but it automatically restarts write()
 247  * operations with a recoverable error (EAGAIN and EINTR). xwrite() DOES NOT
 248  * GUARANTEE that "len" bytes is written even if the operation is successful.
 249  */
 250 ssize_t xwrite(int fd, const void *buf, size_t len)
 251 {
 252         ssize_t nr;
 253         if (len > MAX_IO_SIZE)
 254                 len = MAX_IO_SIZE;
 255         while (1) {
 256                 nr = write(fd, buf, len);
 257                 if (nr < 0) {
 258                         if (errno == EINTR)
 259                                 continue;
 260                         if (handle_nonblock(fd, POLLOUT, errno))
 261                                 continue;
 262                 }
 263
 264                 return nr;
 265         }
 266 }
 267
 268 /*
 269  * xpread() is the same as pread(), but it automatically restarts pread()
 270  * operations with a recoverable error (EAGAIN and EINTR). xpread() DOES
 271  * NOT GUARANTEE that "len" bytes is read even if the data is available.
 272  */
 273 ssize_t xpread(int fd, void *buf, size_t len, off_t offset)
 274 {
 275         ssize_t nr;
 276         if (len > MAX_IO_SIZE)
 277                 len = MAX_IO_SIZE;
 278         while (1) {
 279                 nr = pread(fd, buf, len, offset);
 280                 if ((nr < 0) && (errno == EAGAIN || errno == EINTR))
 281                         continue;
 282                 return nr;
 283         }
 284 }
 285
 286 ssize_t read_in_full(int fd, void *buf, size_t count)
 287 {
 288         char *p = buf;
 289         ssize_t total = 0;
 290
 291         while (count > 0) {
 292                 ssize_t loaded = xread(fd, p, count);
 293                 if (loaded < 0)
 294                         return -1;
 295                 if (loaded == 0)
 296                         return total;
 297                 count -= loaded;
 298                 p += loaded;
 299                 total += loaded;
 300         }
 301
 302         return total;
 303 }
 304
 305 ssize_t write_in_full(int fd, const void *buf, size_t count)
 306 {
 307         const char *p = buf;
 308         ssize_t total = 0;
 309
 310         while (count > 0) {
 311                 ssize_t written = xwrite(fd, p, count);
 312                 if (written < 0)
 313                         return -1;
 314                 if (!written) {
 315                         errno = ENOSPC;
 316                         return -1;
 317                 }
 318                 count -= written;
 319                 p += written;
 320                 total += written;
 321         }
 322
 323         return total;
 324 }
 325
 326 ssize_t pread_in_full(int fd, void *buf, size_t count, off_t offset)
 327 {
 328         char *p = buf;
 329         ssize_t total = 0;
 330
 331         while (count > 0) {
 332                 ssize_t loaded = xpread(fd, p, count, offset);
 333                 if (loaded < 0)
 334                         return -1;
 335                 if (loaded == 0)
 336                         return total;
 337                 count -= loaded;
 338                 p += loaded;
 339                 total += loaded;
 340                 offset += loaded;
 341         }
 342
 343         return total;
 344 }
 345
 346 int xdup(int fd)
 347 {
 348         int ret = dup(fd);
 349         if (ret < 0)
 350                 die_errno("dup failed");
 351         return ret;
 352 }
 353
 354 /**
 355  * xfopen() is the same as fopen(), but it die()s if the fopen() fails.
 356  */
 357 FILE *xfopen(const char *path, const char *mode)
 358 {
 359         for (;;) {
 360                 FILE *fp = fopen(path, mode);
 361                 if (fp)
 362                         return fp;
 363                 if (errno == EINTR)
 364                         continue;
 365
 366                 if (*mode && mode[1] == '+')
 367                         die_errno(_("could not open '%s' for reading and writing"), path);
 368                 else if (*mode == 'w' || *mode == 'a')
 369                         die_errno(_("could not open '%s' for writing"), path);
 370                 else
 371                         die_errno(_("could not open '%s' for reading"), path);
 372         }
 373 }
 374
 375 FILE *xfdopen(int fd, const char *mode)
 376 {
 377         FILE *stream = fdopen(fd, mode);
 378         if (!stream)
 379                 die_errno("Out of memory? fdopen failed");
 380         return stream;
 381 }
 382
 383 FILE *fopen_for_writing(const char *path)
 384 {
 385         FILE *ret = fopen(path, "w");
 386
 387         if (!ret && errno == EPERM) {
 388                 if (!unlink(path))
 389                         ret = fopen(path, "w");
 390                 else
 391                         errno = EPERM;
 392         }
 393         return ret;
 394 }
 395
 396 static void warn_on_inaccessible(const char *path)
 397 {
 398         warning_errno(_("unable to access '%s'"), path);
 399 }
 400
 401 int warn_on_fopen_errors(const char *path)
 402 {
 403         if (errno != ENOENT && errno != ENOTDIR) {
 404                 warn_on_inaccessible(path);
 405                 return -1;
 406         }
 407
 408         return 0;
 409 }
 410
 411 FILE *fopen_or_warn(const char *path, const char *mode)
 412 {
 413         FILE *fp = fopen(path, mode);
 414
 415         if (fp)
 416                 return fp;
 417
 418         warn_on_fopen_errors(path);
 419         return NULL;
 420 }
 421
 422 int xmkstemp(char *filename_template)
 423 {
 424         int fd;
 425         char origtemplate[PATH_MAX];
 426         strlcpy(origtemplate, filename_template, sizeof(origtemplate));
 427
 428         fd = mkstemp(filename_template);
 429         if (fd < 0) {
 430                 int saved_errno = errno;
 431                 const char *nonrelative_template;
 432
 433                 if (strlen(filename_template) != strlen(origtemplate))
 434                         filename_template = origtemplate;
 435
 436                 nonrelative_template = absolute_path(filename_template);
 437                 errno = saved_errno;
 438                 die_errno("Unable to create temporary file '%s'",
 439                         nonrelative_template);
 440         }
 441         return fd;
 442 }
 443
 444 /* Adapted from libiberty's mkstemp.c. */
 445
 446 #undef TMP_MAX
 447 #define TMP_MAX 16384
 448
 449 int git_mkstemps_mode(char *pattern, int suffix_len, int mode)
 450 {
 451         static const char letters[] =
 452                 "abcdefghijklmnopqrstuvwxyz"
 453                 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 454                 "0123456789";
 455         static const int num_letters = ARRAY_SIZE(letters) - 1;
 456         static const char x_pattern[] = "XXXXXX";
 457         static const int num_x = ARRAY_SIZE(x_pattern) - 1;
 458         char *filename_template;
 459         size_t len;
 460         int fd, count;
 461
 462         len = strlen(pattern);
 463
 464         if (len < num_x + suffix_len) {
 465                 errno = EINVAL;
 466                 return -1;
 467         }
 468
 469         if (strncmp(&pattern[len - num_x - suffix_len], x_pattern, num_x)) {
 470                 errno = EINVAL;
 471                 return -1;
 472         }
 473
 474         /*
 475          * Replace pattern's XXXXXX characters with randomness.
 476          * Try TMP_MAX different filenames.
 477          */
 478         filename_template = &pattern[len - num_x - suffix_len];
 479         for (count = 0; count < TMP_MAX; ++count) {
 480                 int i;
 481                 uint64_t v;
 482                 if (csprng_bytes(&v, sizeof(v), 0) < 0)
 483                         return error_errno("unable to get random bytes for temporary file");
 484
 485                 /* Fill in the random bits. */
 486                 for (i = 0; i < num_x; i++) {
 487                         filename_template[i] = letters[v % num_letters];
 488                         v /= num_letters;
 489                 }
 490
 491                 fd = open(pattern, O_CREAT | O_EXCL | O_RDWR, mode);
 492                 if (fd >= 0)
 493                         return fd;
 494                 /*
 495                  * Fatal error (EPERM, ENOSPC etc).
 496                  * It doesn't make sense to loop.
 497                  */
 498                 if (errno != EEXIST)
 499                         break;
 500         }
 501         /* We return the null string if we can't find a unique file name.  */
 502         pattern[0] = '\0';
 503         return -1;
 504 }
 505
 506 int git_mkstemp_mode(char *pattern, int mode)
 507 {
 508         /* mkstemp is just mkstemps with no suffix */
 509         return git_mkstemps_mode(pattern, 0, mode);
 510 }
 511
 512 int xmkstemp_mode(char *filename_template, int mode)
 513 {
 514         int fd;
 515         char origtemplate[PATH_MAX];
 516         strlcpy(origtemplate, filename_template, sizeof(origtemplate));
 517
 518         fd = git_mkstemp_mode(filename_template, mode);
 519         if (fd < 0) {
 520                 int saved_errno = errno;
 521                 const char *nonrelative_template;
 522
 523                 if (!filename_template[0])
 524                         filename_template = origtemplate;
 525
 526                 nonrelative_template = absolute_path(filename_template);
 527                 errno = saved_errno;
 528                 die_errno("Unable to create temporary file '%s'",
 529                         nonrelative_template);
 530         }
 531         return fd;
 532 }
 533
 534 /*
 535  * Some platforms return EINTR from fsync. Since fsync is invoked in some
 536  * cases by a wrapper that dies on failure, do not expose EINTR to callers.
 537  */
 538 static int fsync_loop(int fd)
 539 {
 540         int err;
 541
 542         do {
 543                 err = fsync(fd);
 544         } while (err < 0 && errno == EINTR);
 545         return err;
 546 }
 547
 548 int git_fsync(int fd, enum fsync_action action)
 549 {
 550         switch (action) {
 551         case FSYNC_WRITEOUT_ONLY:
 552                 trace2_counter_add(TRACE2_COUNTER_ID_FSYNC_WRITEOUT_ONLY, 1);
 553
 554 #ifdef __APPLE__
 555                 /*
 556                  * On macOS, fsync just causes filesystem cache writeback but
 557                  * does not flush hardware caches.
 558                  */
 559                 return fsync_loop(fd);
 560 #endif
 561
 562 #ifdef HAVE_SYNC_FILE_RANGE
 563                 /*
 564                  * On linux 2.6.17 and above, sync_file_range is the way to
 565                  * issue a writeback without a hardware flush. An offset of
 566                  * 0 and size of 0 indicates writeout of the entire file and the
 567                  * wait flags ensure that all dirty data is written to the disk
 568                  * (potentially in a disk-side cache) before we continue.
 569                  */
 570
 571                 return sync_file_range(fd, 0, 0, SYNC_FILE_RANGE_WAIT_BEFORE |
 572                                                  SYNC_FILE_RANGE_WRITE |
 573                                                  SYNC_FILE_RANGE_WAIT_AFTER);
 574 #endif
 575
 576 #ifdef fsync_no_flush
 577                 return fsync_no_flush(fd);
 578 #endif
 579
 580                 errno = ENOSYS;
 581                 return -1;
 582
 583         case FSYNC_HARDWARE_FLUSH:
 584                 trace2_counter_add(TRACE2_COUNTER_ID_FSYNC_HARDWARE_FLUSH, 1);
 585
 586                 /*
 587                  * On macOS, a special fcntl is required to really flush the
 588                  * caches within the storage controller. As of this writing,
 589                  * this is a very expensive operation on Apple SSDs.
 590                  */
 591 #ifdef __APPLE__
 592                 return fcntl(fd, F_FULLFSYNC);
 593 #else
 594                 return fsync_loop(fd);
 595 #endif
 596         default:
 597                 BUG("unexpected git_fsync(%d) call", action);
 598         }
 599 }
 600
 601 static int warn_if_unremovable(const char *op, const char *file, int rc)
 602 {
 603         int err;
 604         if (!rc || errno == ENOENT)
 605                 return 0;
 606         err = errno;
 607         warning_errno("unable to %s '%s'", op, file);
 608         errno = err;
 609         return rc;
 610 }
 611
 612 int unlink_or_msg(const char *file, struct strbuf *err)
 613 {
 614         int rc = unlink(file);
 615
 616         assert(err);
 617
 618         if (!rc || errno == ENOENT)
 619                 return 0;
 620
 621         strbuf_addf(err, "unable to unlink '%s': %s",
 622                     file, strerror(errno));
 623         return -1;
 624 }
 625
 626 int unlink_or_warn(const char *file)
 627 {
 628         return warn_if_unremovable("unlink", file, unlink(file));
 629 }
 630
 631 int rmdir_or_warn(const char *file)
 632 {
 633         return warn_if_unremovable("rmdir", file, rmdir(file));
 634 }
 635
 636 static int access_error_is_ok(int err, unsigned flag)
 637 {
 638         return (is_missing_file_error(err) ||
 639                 ((flag & ACCESS_EACCES_OK) && err == EACCES));
 640 }
 641
 642 int access_or_warn(const char *path, int mode, unsigned flag)
 643 {
 644         int ret = access(path, mode);
 645         if (ret && !access_error_is_ok(errno, flag))
 646                 warn_on_inaccessible(path);
 647         return ret;
 648 }
 649
 650 int access_or_die(const char *path, int mode, unsigned flag)
 651 {
 652         int ret = access(path, mode);
 653         if (ret && !access_error_is_ok(errno, flag))
 654                 die_errno(_("unable to access '%s'"), path);
 655         return ret;
 656 }
 657
 658 char *xgetcwd(void)
 659 {
 660         struct strbuf sb = STRBUF_INIT;
 661         if (strbuf_getcwd(&sb))
 662                 die_errno(_("unable to get current working directory"));
 663         return strbuf_detach(&sb, NULL);
 664 }
 665
 666 int xsnprintf(char *dst, size_t max, const char *fmt, ...)
 667 {
 668         va_list ap;
 669         int len;
 670
 671         va_start(ap, fmt);
 672         len = vsnprintf(dst, max, fmt, ap);
 673         va_end(ap);
 674
 675         if (len < 0)
 676                 die(_("unable to format message: %s"), fmt);
 677         if (len >= max)
 678                 BUG("attempt to snprintf into too-small buffer");
 679         return len;
 680 }
 681
 682 void write_file_buf(const char *path, const char *buf, size_t len)
 683 {
 684         int fd = xopen(path, O_WRONLY | O_CREAT | O_TRUNC, 0666);
 685         if (write_in_full(fd, buf, len) < 0)
 686                 die_errno(_("could not write to '%s'"), path);
 687         if (close(fd))
 688                 die_errno(_("could not close '%s'"), path);
 689 }
 690
 691 void write_file(const char *path, const char *fmt, ...)
 692 {
 693         va_list params;
 694         struct strbuf sb = STRBUF_INIT;
 695
 696         va_start(params, fmt);
 697         strbuf_vaddf(&sb, fmt, params);
 698         va_end(params);
 699
 700         strbuf_complete_line(&sb);
 701
 702         write_file_buf(path, sb.buf, sb.len);
 703         strbuf_release(&sb);
 704 }
 705
 706 void sleep_millisec(int millisec)
 707 {
 708         poll(NULL, 0, millisec);
 709 }
 710
 711 int xgethostname(char *buf, size_t len)
 712 {
 713         /*
 714          * If the full hostname doesn't fit in buf, POSIX does not
 715          * specify whether the buffer will be null-terminated, so to
 716          * be safe, do it ourselves.
 717          */
 718         int ret = gethostname(buf, len);
 719         if (!ret)
 720                 buf[len - 1] = 0;
 721         return ret;
 722 }
 723
 724 int is_empty_or_missing_file(const char *filename)
 725 {
 726         struct stat st;
 727
 728         if (stat(filename, &st) < 0) {
 729                 if (errno == ENOENT)
 730                         return 1;
 731                 die_errno(_("could not stat %s"), filename);
 732         }
 733
 734         return !st.st_size;
 735 }
 736
 737 int open_nofollow(const char *path, int flags)
 738 {
 739 #ifdef O_NOFOLLOW
 740         int ret = open(path, flags | O_NOFOLLOW);
 741         /*
 742          * NetBSD sets errno to EFTYPE when path is a symlink. The only other
 743          * time this errno occurs when O_REGULAR is used. Since we don't use
 744          * it anywhere we can avoid an lstat here. FreeBSD does the same with
 745          * EMLINK.
 746          */
 747 # ifdef __NetBSD__
 748 #  define SYMLINK_ERRNO EFTYPE
 749 # elif defined(__FreeBSD__)
 750 #  define SYMLINK_ERRNO EMLINK
 751 # endif
 752 # if SYMLINK_ERRNO
 753         if (ret < 0 && errno == SYMLINK_ERRNO) {
 754                 errno = ELOOP;
 755                 return -1;
 756         }
 757 #  undef SYMLINK_ERRNO
 758 # endif
 759         return ret;
 760 #else
 761         struct stat st;
 762         if (lstat(path, &st) < 0)
 763                 return -1;
 764         if (S_ISLNK(st.st_mode)) {
 765                 errno = ELOOP;
 766                 return -1;
 767         }
 768         return open(path, flags);
 769 #endif
 770 }
 771
 772 int csprng_bytes(void *buf, size_t len, MAYBE_UNUSED unsigned flags)
 773 {
 774 #if defined(HAVE_ARC4RANDOM) || defined(HAVE_ARC4RANDOM_LIBBSD)
 775         /* This function never returns an error. */
 776         arc4random_buf(buf, len);
 777         return 0;
 778 #elif defined(HAVE_GETRANDOM)
 779         ssize_t res;
 780         char *p = buf;
 781         while (len) {
 782                 res = getrandom(p, len, 0);
 783                 if (res < 0)
 784                         return -1;
 785                 len -= res;
 786                 p += res;
 787         }
 788         return 0;
 789 #elif defined(HAVE_GETENTROPY)
 790         int res;
 791         char *p = buf;
 792         while (len) {
 793                 /* getentropy has a maximum size of 256 bytes. */
 794                 size_t chunk = len < 256 ? len : 256;
 795                 res = getentropy(p, chunk);
 796                 if (res < 0)
 797                         return -1;
 798                 len -= chunk;
 799                 p += chunk;
 800         }
 801         return 0;
 802 #elif defined(HAVE_RTLGENRANDOM)
 803         if (!RtlGenRandom(buf, len))
 804                 return -1;
 805         return 0;
 806 #elif defined(HAVE_OPENSSL_CSPRNG)
 807         switch (RAND_pseudo_bytes(buf, len)) {
 808         case 1:
 809                 return 0;
 810         case 0:
 811                 if (flags & CSPRNG_BYTES_INSECURE)
 812                         return 0;
 813                 errno = EIO;
 814                 return -1;
 815         default:
 816                 errno = ENOTSUP;
 817                 return -1;
 818         }
 819 #else
 820         ssize_t res;
 821         char *p = buf;
 822         int fd, err;
 823         fd = open("/dev/urandom", O_RDONLY);
 824         if (fd < 0)
 825                 return -1;
 826         while (len) {
 827                 res = xread(fd, p, len);
 828                 if (res < 0) {
 829                         err = errno;
 830                         close(fd);
 831                         errno = err;
 832                         return -1;
 833                 }
 834                 len -= res;
 835                 p += res;
 836         }
 837         close(fd);
 838         return 0;
 839 #endif
 840 }
 841
 842 uint32_t git_rand(unsigned flags)
 843 {
 844         uint32_t result;
 845
 846         if (csprng_bytes(&result, sizeof(result), flags) < 0)
 847                 die(_("unable to get random bytes"));
 848
 849         return result;
 850 }
 851
 852 static void mmap_limit_check(size_t length)
 853 {
 854         static size_t limit = 0;
 855         if (!limit) {
 856                 limit = git_env_ulong("GIT_MMAP_LIMIT", 0);
 857                 if (!limit)
 858                         limit = SIZE_MAX;
 859         }
 860         if (length > limit)
 861                 die(_("attempting to mmap %"PRIuMAX" over limit %"PRIuMAX),
 862                     (uintmax_t)length, (uintmax_t)limit);
 863 }
 864
 865 void *xmmap_gently(void *start, size_t length,
 866                   int prot, int flags, int fd, off_t offset)
 867 {
 868         void *ret;
 869
 870         mmap_limit_check(length);
 871         ret = mmap(start, length, prot, flags, fd, offset);
 872         if (ret == MAP_FAILED && !length)
 873                 ret = NULL;
 874         return ret;
 875 }
 876
 877 const char *mmap_os_err(void)
 878 {
 879         static const char blank[] = "";
 880 #if defined(__linux__)
 881         if (errno == ENOMEM) {
 882                 /* this continues an existing error message: */
 883                 static const char enomem[] =
 884 ", check sys.vm.max_map_count and/or RLIMIT_DATA";
 885                 return enomem;
 886         }
 887 #endif /* OS-specific bits */
 888         return blank;
 889 }
 890
 891 void *xmmap(void *start, size_t length,
 892         int prot, int flags, int fd, off_t offset)
 893 {
 894         void *ret = xmmap_gently(start, length, prot, flags, fd, offset);
 895         if (ret == MAP_FAILED)
 896                 die_errno(_("mmap failed%s"), mmap_os_err());
 897         return ret;
 898 }