We currently generate the command-line for the external
command using a fixed-length array of size 10. But if there
is a rename, we actually need 11 elements (10 items, plus a
NULL), and end up writing a random NULL onto the stack.

Rather than bump the limit, let's just use an argv_array, which
makes this sort of error impossible.
Noticed-by: NMax L <infthi.inbox@gmail.com>
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

The second maintenance release for Git 1.9; contains all the fixes
that are scheduled to appear in Git 2.0.
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

* jl/nor-or-nand-and:
  code and test: fix misuses of "nor"
  comments: fix misuses of "nor"
  contrib: fix misuses of "nor"
  Documentation: fix misuses of "nor"

* cn/fetch-prune-overlapping-destination:
  fetch: handle overlaping refspecs on --prune
  fetch: add a failing test for prunning with overlapping refspecs

* mh/update-ref-batch-create-fix:
  update-ref: fail create operation over stdin if ref already exists

* jk/commit-dates-parsing-fix:
  t4212: loosen far-in-future test for AIX
  date: recognize bogus FreeBSD gmtime output

* jc/fix-diff-no-index-diff-opt-parse:
  diff-no-index: correctly diagnose error return from diff_opt_parse()

* commit '5df05146':
  doc/http-backend: missing accent grave in literal mark-up

Signed-off-by: NThomas Ackermann <th.acker@arcor.de>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

* mm/status-porcelain-format-i18n-fix:
  status: disable translation when --porcelain is used

* bp/commit-p-editor:
  run-command: mark run_hook_with_custom_index as deprecated
  merge hook tests: fix and update tests
  merge: fix GIT_EDITOR override for commit hook
  commit: fix patch hunk editing with "commit -p -m"
  test patch hunk editing with "commit -p -m"
  merge hook tests: use 'test_must_fail' instead of '!'
  merge hook tests: fix missing '&&' in test

Signed-off-by: NJunio C Hamano <gitster@pobox.com>

* jk/mv-submodules-fix:
  mv: prevent mismatched data when ignoring errors.
  builtin/mv: fix out of bounds write

Conflicts:
	t/t7001-mv.sh

* mh/remove-subtree-long-pathname-fix:
  entry.c: fix possible buffer overflow in remove_subtree()
  checkout_entry(): use the strbuf throughout the function

* jk/lib-terminal-lazy:
  t/lib-terminal: make TTY a lazy prerequisite

* nd/index-pack-error-message:
  index-pack: report error using the correct variable

* us/printf-not-echo:
  test-lib.sh: do not "echo" caller-supplied strings
  rebase -i: do not "echo" random user-supplied strings

* rr/doc-merge-strategies:
  Documentation/merge-strategies: avoid hyphenated commands

* jk/shallow-update-fix:
  shallow: verify shallow file after taking lock
  shallow: automatically clean up shallow tempfiles
  shallow: use stat_validity to check for up-to-date file

* jc/stash-pop-not-popped:
  stash pop: mention we did not drop the stash upon failing to apply

* jn/wt-status:
  wt-status: lift the artificual "at least 20 columns" floor
  wt-status: i18n of section labels
  wt-status: extract the code to compute width for labels
  wt-status: make full label string to be subject to l10n

Signed-off-by: NAman Gupta <aman@tmm1.net>
Signed-off-by: NMichael Haggerty <mhagger@alum.mit.edu>
Acked-by: NBrad King <brad.king@kitware.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

One of the tests in t4212 checks our behavior when we feed
gmtime a date so far in the future that it gives up and
returns NULL. Some implementations, like AIX, may actually
just provide us a bogus result instead.

It's not worth it for us to come up with heuristics that
guess whether the return value is sensible or not. On good
platforms where gmtime reports the problem to us with NULL,
we will print the epoch value. On bad platforms, we will
print garbage.  But our test should be written for the
lowest common denominator so that it passes everywhere.
Reported-by: NCharles Bailey <cbailey32@bloomberg.net>
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Most gmtime implementations return a NULL value when they
encounter an error (and this behavior is specified by ANSI C
and POSIX).  FreeBSD's implementation, however, will simply
leave the "struct tm" untouched.  Let's also recognize this
and convert it to a NULL (with this patch, t4212 should pass
on FreeBSD).
Reported-by: NRené Scharfe <l.s.r@web.de>
Signed-off-by: NJeff King <peff@peff.net>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJustin Lebar <jlebar@google.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJustin Lebar <jlebar@google.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJustin Lebar <jlebar@google.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

Signed-off-by: NJustin Lebar <jlebar@google.com>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

diff_opt_parse() returns the number of options parsed, or often
returns error() which is defined to return -1.  Yes, return value of
0 is "I did not process that option at all", which should cause the
caller to say that, but negative return should not be forgotten.

This bug caused "diff --no-index" to infinitely show the same error
message because the returned value was used to decrement the loop
control variable, e.g.

        $ git diff --no-index --color=words a b
        error: option `color' expects "always", "auto", or "never"
        error: option `color' expects "always", "auto", or "never"
        ...

Instead, make it act like so:

        $ git diff --no-index --color=words a b
        error: option `color' expects "always", "auto", or "never"
        fatal: invalid diff option/value: --color=words
Reported-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

We need to consider that a remote-tracking branch may match more than
one rhs of a fetch refspec. In such a case, it is not enough to stop at
the first match but look at all of the matches in order to determine
whether a head is stale.

To this goal, introduce a variant of query_refspecs which returns all of
the matching refspecs and loop over those answers to check for
staleness.
Signed-off-by: NCarlos Martín Nieto <cmn@elego.de>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

"git status --branch --porcelain" displays the status of the branch
(ahead, behind, gone), and used gettext to translate the string.

Use hardcoded strings when --porcelain is used, but keep the gettext
translation for "git status --short" which is essentially the same, but
meant to be read by a human.
Reported-by: NAnarky <ghostanarky@gmail.com>
Signed-off-by: NMatthieu Moy <Matthieu.Moy@imag.fr>
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

The version numbering scheme has changed since Git 1.9 and we
dropped the third dewey-decimal from the traditional numbering
(e.g. both 1.8.4 and 1.8.5 were major feature releases).  This
release 1.9.1 is the first maintenance relase for Git 1.9.
Signed-off-by: NJunio C Hamano <gitster@pobox.com>

"git clean -d pathspec" did not use the given pathspec correctly
and ended up cleaning too much.

* jk/clean-d-pathspec:
  clean: simplify dir/not-dir logic
  clean: respect pathspecs with "-d"

"git difftool" misbehaved when the repository is bound to the
working tree with the ".git file" mechanism, where a textual file
".git" tells us where it is.

* da/difftool-git-files:
  t7800: add a difftool test for .git-files
  difftool: support repositories with .git-files

"git push" did not pay attention to branch.*.pushremote if it is
defined earlier than remote.pushdefault; the order of these two
variables in the configuration file should not matter, but it did by
mistake.

* jk/remote-pushremote-config-reading:
  remote: handle pushremote config in any order

Codepaths that parse timestamps in commit objects have been
tightened.

* jk/commit-dates-parsing-fix:
  show_ident_date: fix tz range check
  log: do not segfault on gmtime errors
  log: handle integer overflow in timestamps
  date: check date overflow against time_t
  fsck: report integer overflow in author timestamps
  t4212: test bogus timestamps with git-log

"git diff --external-diff" incorrectly fed the submodule directory
in the working tree to the external diff driver when it knew it is
the same as one of the versions being compared.

* tr/diff-submodule-no-reuse-worktree:
  diff: do not reuse_worktree_file for submodules

"git reset" needs to refresh the index when working in a working
tree (it can also be used to match the index to the HEAD in an
otherwise bare repository), but it failed to set up the working
tree properly, causing GIT_WORK_TREE to be ignored.

* nd/reset-setup-worktree:
  reset: optionally setup worktree and refresh index on --mixed

"git check-attr" when working on a repository with a working tree
did not work well when the working tree was specified via the
--work-tree (and obviously with --git-dir) option.

* jc/check-attr-honor-working-tree:
  check-attr: move to the top of working tree when in non-bare repository
  t0003: do not chdir the whole test process