name-rev: avoid cutoff timestamp underflow

When 'git name-rev' is invoked with commit-ish parameters, it tries to
save some work, and doesn't visit commits older than the committer
date of the oldest given commit minus a one day worth of slop.  Since
our 'timestamp_t' is an unsigned type, this leads to a timestamp
underflow when the committer date of the oldest given commit is within
a day of the UNIX epoch.  As a result the cutoff timestamp ends up
far-far in the future, and 'git name-rev' doesn't visit any commits,
and names each given commit as 'undefined'.

Check whether subtracting the slop from the oldest committer date
would lead to an underflow, and use no cutoff in that case.  We don't
have a TIME_MIN constant, dddbad728c (timestamp_t: a new data type for
timestamps, 2017-04-26) didn't add one, so do it now.

Note that the type of the cutoff timestamp variable used to be signed
before 5589e87fd8 (name-rev: change a "long" variable to timestamp_t,
2017-05-20).  The behavior was still the same even back then, but the
underflow didn't happen when substracting the slop from the oldest
committer date, but when comparing the signed cutoff timestamp with
unsigned committer dates in name_rev().  IOW, this underflow bug is as
old as 'git name-rev' itself.

Helped-by: Johannes Sixt <j6t@kdbg.org>
Signed-off-by: SZEDER Gábor <szeder.dev@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/builtin/name-rev.c b/builtin/name-rev.c
index c785fe16bade1a67d4da782d91b61bdd61d99115..b0f0776947f05e551f5bd06a4a0e291aa19a56f3 100644 (file)
--- a/builtin/name-rev.c
+++ b/builtin/name-rev.c
@@ -9,7 +9,11 @@
 #include "sha1-lookup.h"
 #include "commit-slab.h"
 
-#define CUTOFF_DATE_SLOP 86400 /* one day */
+/*
+ * One day.  See the 'name a rev shortly after epoch' test in t6120 when
+ * changing this value
+ */
+#define CUTOFF_DATE_SLOP 86400
 
 typedef struct rev_name {
        const char *tip_name;
@@ -481,8 +485,13 @@ int cmd_name_rev(int argc, const char **argv, const char *prefix)
                add_object_array(object, *argv, &revs);
        }
 
-       if (cutoff)
-               cutoff = cutoff - CUTOFF_DATE_SLOP;
+       if (cutoff) {
+               /* check for undeflow */
+               if (cutoff > TIME_MIN + CUTOFF_DATE_SLOP)
+                       cutoff = cutoff - CUTOFF_DATE_SLOP;
+               else
+                       cutoff = TIME_MIN;
+       }
        for_each_ref(name_ref, &data);
 
        if (transform_stdin) {

diff --git a/git-compat-util.h b/git-compat-util.h
index 83be89de0aac7c96799635e3b2858a465f440acf..2e253567fbb8045124f4dcafa051ab048867223d 100644 (file)
--- a/git-compat-util.h
+++ b/git-compat-util.h
@@ -344,6 +344,7 @@ typedef uintmax_t timestamp_t;
 #define PRItime PRIuMAX
 #define parse_timestamp strtoumax
 #define TIME_MAX UINTMAX_MAX
+#define TIME_MIN 0
 
 #ifndef PATH_SEP
 #define PATH_SEP ':'

diff --git a/t/t6120-describe.sh b/t/t6120-describe.sh
index 2b883d8174036b7d2246fcd89f239d7ecde049d4..45047d0a724e6bb7b59b4b3ae155ced530c660d1 100755 (executable)
--- a/t/t6120-describe.sh
+++ b/t/t6120-describe.sh
@@ -424,4 +424,19 @@ test_expect_success 'describe complains about missing object' '
        test_must_fail git describe $ZERO_OID
 '
 
+test_expect_success 'name-rev a rev shortly after epoch' '
+       test_when_finished "git checkout master" &&
+
+       git checkout --orphan no-timestamp-underflow &&
+       # Any date closer to epoch than the CUTOFF_DATE_SLOP constant
+       # in builtin/name-rev.c.
+       GIT_COMMITTER_DATE="@1234 +0000" \
+       git commit -m "committer date shortly after epoch" &&
+       old_commit_oid=$(git rev-parse HEAD) &&
+
+       echo "$old_commit_oid no-timestamp-underflow" >expect &&
+       git name-rev $old_commit_oid >actual &&
+       test_cmp expect actual
+'
+
 test_done