TapTap/FastSync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix(p7-output-fs): address c-review (fake-super mode sanitization HIGH; sparse/preallocate precedence; partial no_replace guard; stronger tests)

Browse Source 
- fake_super_restore_fd now sanitizes mode like metadata_mode (never grants
  S_IWGRP|S_IWOTH; 0666 -> 0644), fixing a privilege regression
- --sparse takes precedence over --preallocate (skip posix_fallocate when
  sparse) so holes are not re-allocated; docs corrected
- --partial retention disabled under --no_replace (ignore/existing) and only
  marks write_attempted after the write begins (no empty-temp retention)
- accept --block-size=SIZE / --delta-block=SIZE inline forms; neutral messages
- fake-super EPERM/EACCES skipped silently (docs aligned); EINVAL still logged
- sparse unit test now memcmp's the full buffer; TestBlockSize integration keeps
  the destination basis so delta is genuinely exercised
- unit 37/37, cppcheck 0, clang-format 0
This commit is contained in:
TapTap
2026-09-12 09:55:40 +02:00
parent 47de05d215
commit f2ba8211ce
9 changed files with 83 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/file.c
+16 -7
View File
@@ -882,9 +882,12 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
ok = true;
} else {
/* Preallocate the expected payload size before writing so an
out-of-space condition fails cleanly up front (--preallocate). */
out-of-space condition fails cleanly up front (--preallocate).
--sparse takes precedence: posix_fallocate would allocate every
block, defeating the holes the sparse writer would create, so the
two never combine here (the ftruncate presize below stays). */
int prealloc_rc = 0;
if (preallocate && data_size > 0) {
if (preallocate && !sparse && data_size > 0) {
prealloc_rc = preallocate_fd(fd, data_size);
if (prealloc_rc != 0)
log_message(LOG_LEVEL_ERROR, "preallocate failed for '%s' (%s); transfer aborted", path,
@@ -991,20 +994,24 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
if (fd < 0)
continue; /* EEXIST (or a transient open error): try a fresh name. */
int prealloc_rc = 0;
if (preallocate && data_size > 0) {
if (preallocate && !sparse && data_size > 0) {
prealloc_rc = preallocate_fd(fd, data_size);
if (prealloc_rc != 0)
log_message(LOG_LEVEL_ERROR, "preallocate failed for '%s' (%s); transfer aborted", path,
strerror(prealloc_rc));
}
if (prealloc_rc == 0) {
write_attempted = true;
lseek(fd, 0, SEEK_SET);
if (sparse && data_size > 0)
ok = ftruncate(fd, (off_t)data_size) == 0;
if (ok || (!sparse || data_size == 0))
/* A real write attempt begins here (the ftruncate presize succeeded or
no presize applies): a later mid-write / metadata / fsync / install
failure may leave partial data that --partial retention can rename. */
if (ok || (!sparse || data_size == 0)) {
write_attempted = true;
ok = sparse && data_size > 0 ? write_all_sparse(fd, (const unsigned char*)data, data_size)
: write_all(fd, data, data_size);
}
if (ok && metadata)
ok = file_restore_metadata_fd(fd, metadata, preserve_executability);
if (ok)
@@ -1047,8 +1054,10 @@ static bool file_to_disk_secure_impl(const char* path, const void* data,
This only ever renames the already-written temp (never a corrupt
blend); the rename can fail (cross-device, permissions) and we then
fall through to the normal unlink cleanup. Never retains when
keep_partial is off. */
if (!keep_partial || !write_attempted ||
keep_partial is off, when nothing was actually written, or under
--ignore-existing/--existing (no_replace), where the destination is
not ours to overwrite. */
if (!keep_partial || !write_attempted || no_replace ||
renameat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, dirfd, leaf) != 0)
unlinkat(scratch_dirfd >= 0 ? scratch_dirfd : dirfd, tmp, 0);
}