IndexEntry path and flags not safe to expose directly about git2-rs

[alexcrichton]

Oh dear I had no idea!

[joshtriplett]

Investigating more carefully, it looks like libgit2 might handle the length automatically, at least in git_index_add. But it's still not safe to expose path directly, because it must be NUL-terminated.

[alexcrichton]

Yeah this sounds pretty bad all around, and IndexEntry may end up just needing a complete overhaul

[joshtriplett]

A related issue I just ran into: if you read an IndexEntry using git2::Index::get_path, and then add that entry to another index using .git2::Index::add, that can read off the end of the .path field. Whatever safety property .add needs, the IndexEntry returned by .get_path doesn't seem to satisfy.

[alexcrichton]

Oh dear, this appears to be extra bad then! Thanks for the reports!

Ah and I am indeed acrichto on IRC, sorry I missed your ping! I probably won't be able to get around to this until perhaps this weekend at the earliest, but if you want to try to tackle it ahead of time feel free as well!

[alexcrichton]

Ok, can you try giving master a spin? If it works I'll publish a release

[joshtriplett]

@alexcrichton Seems to work; I removed the workarounds I had for NUL handling, and everything seems functional.

I made one comment on the commit, regarding whether IndexEntry should have a Path instead of a Vec<u8> to make it explicit that it shouldn't have NUL handling. Otherwise, this looks good to me.

[alexcrichton]

Ok, thanks for checking!