An empty string as mode specification is accepted silently by git apply,
as Vegard Nossum found out using AFL.  It's interpreted as zero.  Reject
such bogus file modes, and only accept ones consisting exclusively of
octal digits.
Reported-by: NVegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: NRene Scharfe <l.s.r@web.de>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

2c93286a (fix "git apply --index ..." not to deref NULL) added a check
for git patches missing a +++ line, preventing a segfault.  Check for
missing --- lines as well, and add a test for each case.

Found by Vegard Nossum using AFL.
Original-patch-by: NVegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: NRene Scharfe <l.s.r@web.de>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

* jk/shell-no-repository-that-begins-with-dash:
  shell: disallow repo names beginning with dash

When a remote server uses git-shell, the client side will
connect to it like:

  ssh server "git-upload-pack 'foo.git'"

and we literally exec ("git-upload-pack", "foo.git"). In
early versions of upload-pack and receive-pack, we took a
repository argument and nothing else. But over time they
learned to accept dashed options. If the user passes a
repository name that starts with a dash, the results are
confusing at best (we complain of a bogus option instead of
a non-existent repository) and malicious at worst (the user
can start an interactive pager via "--help").

We could pass "--" to the sub-process to make sure the
user's argument is interpreted as a branch name. I.e.:

  git-upload-pack -- -foo.git

But adding "--" automatically would make us inconsistent
with a normal shell (i.e., when git-shell is not in use),
where "-foo.git" would still be an error. For that case, the
client would have to specify the "--", but they can't do so
reliably, as existing versions of git-shell do not allow
more than a single argument.

The simplest thing is to simply disallow "-" at the start of
the repo name argument. This hasn't worked either with or
without git-shell since version 1.0.0, and nobody has
complained.

Note that this patch just applies to do_generic_cmd(), which
runs upload-pack, receive-pack, and upload-archive. There
are two other types of commands that git-shell runs:

  - do_cvs_cmd(), but this already restricts the argument to
    be the literal string "server"

  - admin-provided commands in the git-shell-commands
    directory. We'll pass along arbitrary arguments there,
    so these commands could have similar problems. But these
    commands might actually understand dashed arguments, so
    we cannot just block them here. It's up to the writer of
    the commands to make sure they are safe. With great
    power comes great responsibility.
Reported-by: NTimo Schmid <tschmid@ernw.de>
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Code clean-up.

* ws/request-pull-code-cleanup:
  request-pull: drop old USAGE stuff

Typing ^C to pager, which usually does not kill it, killed Git and
took the pager down as a collateral damage in certain process-tree
structure.  This has been fixed.

* jk/execv-dashed-external:
  execv_dashed_external: wait for child on signal death
  execv_dashed_external: stop exiting with negative code
  execv_dashed_external: use child_process struct

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Documentation and in-code comments updates.

* sb/in-core-index-doc:
  documentation: retire unfinished documentation
  cache.h: document add_[file_]to_index
  cache.h: document remove_index_entry_at
  cache.h: document index_name_pos

An update to a topic that is already in 'master'.

* js/mingw-isatty:
  mingw: follow-up to "replace isatty() hack"

Developer doc update.

* jk/coding-guidelines-update:
  CodingGuidelines: clarify multi-line brace style

Code cleanup.

* js/exec-path-coverity-workaround:
  git_exec_path: do not return the result of getenv()
  git_exec_path: avoid Coverity warning about unfree()d result

Documentation fix.

* ad/bisect-terms:
  Documentation/bisect: improve on (bad|new) and (good|bad)

Tighten a test to avoid mistaking an extended ERE regexp engine as
a PRE regexp engine.

* jk/grep-e-could-be-extended-beyond-posix:
  t7810: avoid assumption about invalid regex syntax

"git <cmd> @{push}" on a detached HEAD used to segfault; it has
been corrected to error out with a message.

* km/branch-get-push-while-detached:
  branch_get_push: do not segfault when HEAD is detached

"git rebase -i" with a recent update started showing an incorrect
count when squashing more than 10 commits.

* jk/rebase-i-squash-count-fix:
  rebase--interactive: count squash commits above 10 correctly

"git blame --porcelain" misidentified the "previous" <commit, path>
pair (aka "source") when contents came from two or more files.

* jk/blame-fixes:
  blame: output porcelain "previous" header for each file
  blame: handle --no-abbrev
  blame: fix alignment with --abbrev=40

"git archive" did not read the standard configuration files, and
failed to notice a file that is marked as binary via the userdiff
driver configuration.

* jk/archive-zip-userdiff-config:
  archive-zip: load userdiff config

It is natural that "git gc --auto" may not attempt to pack
everything into a single pack, and there is no point in warning
when the user has configured the system to use the pack bitmap,
leading to disabling further "gc".

* dt/disable-bitmap-in-auto-gc:
  repack: die on incremental + write-bitmap-index
  auto gc: don't write bitmaps for incremental repacks

Leakage of lockfiles in the config subsystem has been fixed.

* nd/config-misc-fixes:
  config.c: handle lock file in error case in git_config_rename_...
  config.c: rename label unlock_and_out
  config.c: handle error case for fstat() calls

Recent update to the default abbreviation length that auto-scales
lacked documentation update, which has been corrected.

* jc/abbrev-autoscale-config:
  config.abbrev: document the new default that auto-scales

"git fast-import" sometimes mishandled while rebalancing notes
tree, which has been fixed.

* mh/fast-import-notes-fix-new:
  fast-import: properly fanout notes when tree is imported

Compression setting for producing packfiles were spread across
three codepaths, one of which did not honor any configuration.
Unify these so that all of them honor core.compression and
pack.compression variables the same way.

* jc/compression-config:
  compression: unify pack.compression configuration parsing

Meant eventually for 'maint'.

* ew/svn-fixes:
  git-svn: document useLogAuthor and addAuthorFrom config keys
  git-svn: allow "0" in SVN path components

Update the definition of the MacOSX test environment used by
TravisCI.

* ls/travis-p4-on-macos:
  travis-ci: fix Perforce install on macOS