Super long branch names corrupt `.git/config`

Super long branch names corrupt `.git/config`

[Ben Olive]

My `.git/config` can be corrupted if I try to get a local branch with
an extremely long name to track a remote branch.

Here is a (contrived) example to reproduce the issue:


    $ cd /tmp
    $ mkdir buggyrepo otherrepo
    $ cd buggyrepo/ && git init && cd -
    $ cd otherrepo/ && git init && cd -
    $ cd buggyrepo/
    $ echo foo > MYFILE
    $ git add MYFILE && git commit -m "Initial"
    $ git remote add otherrepo ../otherrepo/
    $ git checkout -b `ruby -e "puts 'a'*200"`
    $ git push -u otherrepo `ruby -e "puts 'a'*200"`
    fatal: bad config file line 11 in .git/config
    $ git status
    fatal: bad config file line 11 in .git/config


Workaround available: Just delete the offending entry.

I tested this with 1.7.12.2

--Ben Olive

Re: Super long branch names corrupt `.git/config`

[Jeff King]

On Thu, Oct 04, 2012 at 01:15:25PM -0400, Ben Olive wrote:

> My `.git/config` can be corrupted if I try to get a local branch with
> an extremely long name to track a remote branch.
> 
> Here is a (contrived) example to reproduce the issue:
> 
> 
>     $ cd /tmp
>     $ mkdir buggyrepo otherrepo
>     $ cd buggyrepo/ && git init && cd -
>     $ cd otherrepo/ && git init && cd -
>     $ cd buggyrepo/
>     $ echo foo > MYFILE
>     $ git add MYFILE && git commit -m "Initial"
>     $ git remote add otherrepo ../otherrepo/
>     $ git checkout -b `ruby -e "puts 'a'*200"`
>     $ git push -u otherrepo `ruby -e "puts 'a'*200"`
>     fatal: bad config file line 11 in .git/config
>     $ git status
>     fatal: bad config file line 11 in .git/config
> 
> Workaround available: Just delete the offending entry.
> 
> I tested this with 1.7.12.2

This is fixed by Ben Walton's 0971e99 (Remove the hard coded length
limit on variable names in config files, 2012-09-30). Not sure yet
whether it will make it into v1.8.0 or not.

However, note that the tracking config is only one limit to branch name
length. On many filesystems, you are limited to 256 bytes (or some other
number) per path component, and writing to "refs/heads/aaa{256}.lock"
will fail.

-Peff

Re: Super long branch names corrupt `.git/config`

[Junio C Hamano]

Ben Olive <sionide21@gmail.com> writes:

> My `.git/config` can be corrupted if I try to get a local branch with
> an extremely long name to track a remote branch.
>
> Here is a (contrived) example to reproduce the issue:

Don't do that, then ;-)

I think we have a change that is already cooking.

Ben (Walton), want to add a test for your 0971e99 (Remove the hard
coded length limit on variable names in config files, 2012-09-30)
before it hits 'next', perhaps?

Re: Super long branch names corrupt `.git/config`

[Jeff King]

On Thu, Oct 04, 2012 at 12:28:39PM -0700, Junio C Hamano wrote:

> Ben Olive <sionide21@gmail.com> writes:
> 
> > My `.git/config` can be corrupted if I try to get a local branch with
> > an extremely long name to track a remote branch.
> >
> > Here is a (contrived) example to reproduce the issue:
> 
> Don't do that, then ;-)
> 
> I think we have a change that is already cooking.
> 
> Ben (Walton), want to add a test for your 0971e99 (Remove the hard
> coded length limit on variable names in config files, 2012-09-30)
> before it hits 'next', perhaps?

I came up with this test earlier today when responding in this thread:

diff --git a/t/t7201-co.sh b/t/t7201-co.sh
index be9672e..a32ecd9 100755
--- a/t/t7201-co.sh
+++ b/t/t7201-co.sh
@@ -454,6 +454,11 @@ test_expect_success \
     'checkout with --track, but without -b, fails with too short tracked name' '
     test_must_fail git checkout --track renamer'
 
+test_expect_success 'checkout tracking with long branch name' '
+	z200=$_z40$_z40$_z40$_z40$_z40
+	git checkout --track -b foo-$z200
+'
+
 setup_conflicting_index () {
 	rm -f .git/index &&
 	O=$(echo original | git hash-object -w --stdin) &&

but it feels a little fake. Why 200? Because that will test the config
limit, but will not overflow the NAME_MAX limit (at least not on
Linux! No clue on other platforms) when we try to create
refs/heads/foo-$z200.

So while this is a nice concrete user-visible impact of Ben's patch, I
think it is a little flaky to be testing. We should probably have a
straight config test in t1303, though.

-Peff

Re: Super long branch names corrupt `.git/config`

[Andrew Ardill]

On 5 October 2012 10:29, Jeff King <peff@peff.net> wrote:
>...
>
>but it feels a little fake. Why 200? Because that will test the config
>limit, but will not overflow the NAME_MAX limit (at least not on
>Linux! No clue on other platforms) when we try to create
>refs/heads/foo-$z200.

I can't test this particular case right now, but I recently had an
issue with Windows Server 2008 due to a long filename, that
essentially meant I couldn't move, change owner or change permissions
on the given file. Unless someone has more info I can test a bit
later. Is the idea that we shouldn't allow filenames that will cause
issues with the underlying OS (or other people's OS) or something
else?

Regards,

Andrew Ardill

Re: Super long branch names corrupt `.git/config`

[Jeff King]

On Fri, Oct 05, 2012 at 10:36:52AM +1000, Andrew Ardill wrote:

> On 5 October 2012 10:29, Jeff King <peff@peff.net> wrote:
> >...
> >
> >but it feels a little fake. Why 200? Because that will test the config
> >limit, but will not overflow the NAME_MAX limit (at least not on
> >Linux! No clue on other platforms) when we try to create
> >refs/heads/foo-$z200.
> 
> I can't test this particular case right now, but I recently had an
> issue with Windows Server 2008 due to a long filename, that
> essentially meant I couldn't move, change owner or change permissions
> on the given file. Unless someone has more info I can test a bit
> later. Is the idea that we shouldn't allow filenames that will cause
> issues with the underlying OS (or other people's OS) or something
> else?

I don't think it's that we shouldn't allow such filenames. It's only
that the test is flaky, because making the branch name long enough to
test the relaxed config code means that we may run afoul of filesystem
limitations on creating the ref itself.

It's a separate issue whether we should restrict the length of branch
names in order to protect against filesystem limits. I tend to think
not, as we handle the filesystem error just fine. The only reason to do
so would be to protect people on multi-system projects (e.g., you make a
long branch name on Linux that cannot be fetched to a Windows system. Or
something; I did not check the limits for those systems). But I have
never heard of that happening in practice, so I think we can ignore it
for now.

-Peff