Re: [PATCH] setup: avoid uninitialized use of is_safe in ensure_valid_ownership

[Junio C Hamano <gitster@pobox.com>]

Carlo Marcelo Arenas Belón  <carenas@gmail.com> writes:

> 8959555cee7 (setup_git_directory(): add an owner check for the top-level
> directory, 2022-03-02) adds this member as part of a newly created
> structure that then gets initialized during the callback, but bb50ec3cc30
> (setup: fix safe.directory key not being checked, 2022-04-13) add a
> quick exit from the callback that avoids this initialization unless the
> callback is called with the relevant key.
>
> This leads to this variable not being initialized UNLESS the global config
> has at least one key for safe.directory, so instead initialize it in the
> caller.
>
> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com>
> ---
>  setup.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/setup.c b/setup.c
> index a7b36f3ffbf..17c7f5fc1dc 100644
> --- a/setup.c
> +++ b/setup.c
> @@ -1122,7 +1122,7 @@ static int safe_directory_cb(const char *key, const char *value, void *d)
>  
>  static int ensure_valid_ownership(const char *path)
>  {
> -	struct safe_directory_data data = { .path = path };
> +	struct safe_directory_data data = { .path = path, .is_safe = 0 };

This is not wrong per-se but is not necessary.  Once you have an
initializer, the struct is zero initialized except for members whose
initial values are explicitly mentioned in the initializer.

Sometimes an explicit initialization is a good way to make the
intention of the code clear, and because setting of the .is_safe
member is done inside a callback function, out of sight from the
reader of this function, while the return value does depend on
having a valid value in the .is_safe member, I do not think we mind
this change, though.

But if we were to take it, the justification must be rewritten.  It
is an OK change to clarify the code to human readers.  It is not a
fix to a bug that left a struct member uninitialized.

>  
>  	if (!git_env_bool("GIT_TEST_ASSUME_DIFFERENT_OWNER", 0) &&
>  	    is_path_owned_by_current_user(path))