sha1_loose_object_info: return error for corrupted objects

When sha1_loose_object_info() finds that a loose object file
cannot be stat(2)ed or mmap(2)ed, it returns -1 to signal an
error to the caller.  However, if it found that the loose
object file is corrupt and the object data cannot be used
from it, it stuffs OBJ_BAD into "type" field of the
object_info, but returns zero (i.e., success), which can
confuse callers.

This is due to 052fe5eac (sha1_loose_object_info: make type
lookup optional, 2013-07-12), which switched the return to a
strict success/error, rather than returning the type (but
botched the return).

Callers of regular sha1_object_info() don't notice the
difference, as that function returns the type (which is
OBJ_BAD in this case). However, direct callers of
sha1_object_info_extended() see the function return success,
but without setting any meaningful values in the object_info
struct, leading them to access potentially uninitialized
memory.

The easiest way to see the bug is via "cat-file -s", which
will happily ignore the corruption and report whatever
value happened to be in the "size" variable.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>

diff --git a/sha1_file.c b/sha1_file.c
index d77b915db699f6f58731f645d6bcc188843d9eb8..b8fbcc54c5a43dc7d7368426e06573e512078fe1 100644 (file)
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -2867,7 +2867,7 @@ static int sha1_loose_object_info(const unsigned char *sha1,
        if (status && oi->typep)
                *oi->typep = status;
        strbuf_release(&hdrbuf);
-       return 0;
+       return (status < 0) ? status : 0;
 }
 
 int sha1_object_info_extended(const unsigned char *sha1, struct object_info *oi, unsigned flags)

diff --git a/t/t1060-object-corruption.sh b/t/t1060-object-corruption.sh
index 3f8705139d74e8e358ae60cabe5d1cd92d316489..3a88d79c5fe95d78e7669d4b04f8602b753ed7a7 100755 (executable)
--- a/t/t1060-object-corruption.sh
+++ b/t/t1060-object-corruption.sh
@@ -53,6 +53,13 @@ test_expect_success 'streaming a corrupt blob fails' '
        )
 '
 
+test_expect_success 'getting type of a corrupt blob fails' '
+       (
+               cd bit-error &&
+               test_must_fail git cat-file -s HEAD:content.t
+       )
+'
+
 test_expect_success 'read-tree -u detects bit-errors in blobs' '
        (
                cd bit-error &&