On Wed, Aug 27, 2014 at 12:41:57AM -0400, David Turner wrote: > git mktree seems to allow the creation of a tree object with multiple > objects of the same name but different SHAs. Yeah, I don't think we do many quality checks there. Ditto for "git hash-object". The latter goes through index_mem, which at least checks that the resulting tree is parseable. It does not look like mktree even checks that. > Summary: git mktree ought to forbid this, and possibly there ought to be > other checks (for instance, when unpacking) to prevent this. The checks in git-fsck will notice your problem (and many others). I think we should be running them anytime we create an object based on arbitrary data (including mktree and hash-object). Code paths like "git write-tree" and "git commit-tree" are probably OK, as their code should follow the standard (it would not hurt to double-check their output, though there may be a performance implication). Dscho (cc'd) has been looking into this approach; I don't know how far he has gotten. -Peff -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html