[PATCH 0/6] zlib only processes 4GB at a time

[PATCH 0/6] zlib only processes 4GB at a time

[Junio C Hamano]

This is a re-roll from yesterday's series, taking a very different
approach. Instead of fixing call sites one by one, the goal is to define
our own API that can give an illusion to the callers that they can feed
and receive data whose size can fit within "unsigned long", so that they
can set up the avail_in field of z_stream (now git_zstream) to the total
size, and expect it to fall down to zero when everything is consumed by
the library (vice versa for avail_out).

The first 5 patches clean up the existing callers that directly call into
zlib to call git_inflate and git_deflate wrappers.

Patch 6 introduces git_zstream that is a thin wrapper around z_stream,
but barfs when the caller gives a buffer larger than 4GB that would fit
the underlying zlib calling convention.

The next step would be to tweak zlib_post_call(), git_inflate() and
git_deflate() functions to internally loop and call underlying inflate()
and deflate() when the incoming buffers are larger than 4GB, but that
part is not done in this series (yet).

Junio C Hamano (6):
  zlib: refactor error message formatter
  zlib: wrap remaining calls to direct inflate/inflateEnd
  zlib: wrap inflateInit2 used to accept only for gzip format
  zlib: wrap deflate side of the API
  zlib: wrap deflateBound() too
  zlib: zlib can only process 4GB at a time

 archive-zip.c            |   10 +-
 builtin/apply.c          |    2 +-
 builtin/index-pack.c     |   12 ++--
 builtin/pack-objects.c   |   18 ++--
 builtin/unpack-objects.c |    2 +-
 cache.h                  |   30 +++++--
 diff.c                   |   10 +-
 fast-import.c            |   30 +++---
 http-backend.c           |   11 +--
 http-push.c              |   16 ++--
 http.h                   |    2 +-
 pack-check.c             |    4 +-
 remote-curl.c            |   14 +--
 sha1_file.c              |   28 +++---
 zlib.c                   |  218 +++++++++++++++++++++++++++++++++++++++-------
 15 files changed, 283 insertions(+), 124 deletions(-)

-- 
1.7.6.rc1.118.ge175b4a

[PATCH 1/6] zlib: refactor error message formatter

[Junio C Hamano]

Before refactoring the main part of the wrappers, first move the
logic to convert error status that come back from zlib to string
to a helper function.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 zlib.c |   73 +++++++++++++++++++++++++++++++++------------------------------
 1 files changed, 38 insertions(+), 35 deletions(-)

diff --git a/zlib.c b/zlib.c
index c4d58da..be9d7e9 100644
--- a/zlib.c
+++ b/zlib.c
@@ -4,58 +4,61 @@
  */
 #include "cache.h"
 
-void git_inflate_init(z_streamp strm)
+static const char *zerr_to_string(int status)
 {
-	const char *err;
-
-	switch (inflateInit(strm)) {
-	case Z_OK:
-		return;
-
+	switch (status) {
 	case Z_MEM_ERROR:
-		err = "out of memory";
-		break;
+		return "out of memory";
 	case Z_VERSION_ERROR:
-		err = "wrong version";
-		break;
+		return "wrong version";
+	case Z_NEED_DICT:
+		return "needs dictionary";
+	case Z_DATA_ERROR:
+		return "data stream error";
+	case Z_STREAM_ERROR:
+		return "stream consistency error";
 	default:
-		err = "error";
+		return "unknown error";
 	}
-	die("inflateInit: %s (%s)", err, strm->msg ? strm->msg : "no message");
 }
 
-void git_inflate_end(z_streamp strm)
+void git_inflate_init(z_streamp strm)
 {
-	if (inflateEnd(strm) != Z_OK)
-		error("inflateEnd: %s", strm->msg ? strm->msg : "failed");
+	int status = inflateInit(strm);
+
+	if (status == Z_OK)
+		return;
+	die("inflateInit: %s (%s)", zerr_to_string(status),
+	    strm->msg ? strm->msg : "no message");
 }
 
-int git_inflate(z_streamp strm, int flush)
+void git_inflate_end(z_streamp strm)
 {
-	int ret = inflate(strm, flush);
-	const char *err;
+	int status = inflateEnd(strm);
 
-	switch (ret) {
-	/* Out of memory is fatal. */
-	case Z_MEM_ERROR:
-		die("inflate: out of memory");
+	if (status == Z_OK)
+		return;
+	error("inflateEnd: %s (%s)", zerr_to_string(status),
+	      strm->msg ? strm->msg : "no message");
+}
 
-	/* Data corruption errors: we may want to recover from them (fsck) */
-	case Z_NEED_DICT:
-		err = "needs dictionary"; break;
-	case Z_DATA_ERROR:
-		err = "data stream error"; break;
-	case Z_STREAM_ERROR:
-		err = "stream consistency error"; break;
-	default:
-		err = "unknown error"; break;
+int git_inflate(z_streamp strm, int flush)
+{
+	int status = inflate(strm, flush);
 
+	switch (status) {
 	/* Z_BUF_ERROR: normal, needs more space in the output buffer */
 	case Z_BUF_ERROR:
 	case Z_OK:
 	case Z_STREAM_END:
-		return ret;
+		return status;
+
+	case Z_MEM_ERROR:
+		die("inflate: out of memory");
+	default:
+		break;
 	}
-	error("inflate: %s (%s)", err, strm->msg ? strm->msg : "no message");
-	return ret;
+	error("inflate: %s (%s)", zerr_to_string(status),
+	      strm->msg ? strm->msg : "no message");
+	return status;
 }
-- 
1.7.6.rc1.118.ge175b4a

[PATCH 2/6] zlib: wrap remaining calls to direct inflate/inflateEnd

[Junio C Hamano]

Two callsites in http-backend.c to inflate() and inflateEnd()
were not using git_ prefixed versions.  After this, running

    $ find all objects -print | xargs nm -ugo | grep inflate

shows only zlib.c makes direct calls to zlib for inflate operation,
except for a singlecall to inflateInit2 in http-backend.c

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 http-backend.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/http-backend.c b/http-backend.c
index 8501504..c74cb03 100644
--- a/http-backend.c
+++ b/http-backend.c
@@ -296,7 +296,7 @@ static void inflate_request(const char *prog_name, int out)
 			stream.next_out = out_buf;
 			stream.avail_out = sizeof(out_buf);
 
-			ret = inflate(&stream, Z_NO_FLUSH);
+			ret = git_inflate(&stream, Z_NO_FLUSH);
 			if (ret != Z_OK && ret != Z_STREAM_END)
 				die("zlib error inflating request, result %d", ret);
 
@@ -311,7 +311,7 @@ static void inflate_request(const char *prog_name, int out)
 	}
 
 done:
-	inflateEnd(&stream);
+	git_inflate_end(&stream);
 	close(out);
 }
 
-- 
1.7.6.rc1.118.ge175b4a

[PATCH 3/6] zlib: wrap inflateInit2 used to accept only for gzip format

[Junio C Hamano]

http-backend.c uses inflateInit2() to tell the library that it wants to
accept only gzip format. Wrap it in a helper function so that readers do
not have to wonder what the magic numbers 15 and 16 are for.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 cache.h        |    1 +
 http-backend.c |    5 +----
 zlib.c         |   15 +++++++++++++++
 3 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/cache.h b/cache.h
index ce73e1f..50f09d0 100644
--- a/cache.h
+++ b/cache.h
@@ -21,6 +21,7 @@
 #endif
 
 void git_inflate_init(z_streamp strm);
+void git_inflate_init_gzip_only(z_streamp strm);
 void git_inflate_end(z_streamp strm);
 int git_inflate(z_streamp strm, int flush);
 
diff --git a/http-backend.c b/http-backend.c
index c74cb03..ab5015d 100644
--- a/http-backend.c
+++ b/http-backend.c
@@ -275,12 +275,9 @@ static void inflate_request(const char *prog_name, int out)
 	unsigned char in_buf[8192];
 	unsigned char out_buf[8192];
 	unsigned long cnt = 0;
-	int ret;
 
 	memset(&stream, 0, sizeof(stream));
-	ret = inflateInit2(&stream, (15 + 16));
-	if (ret != Z_OK)
-		die("cannot start zlib inflater, zlib err %d", ret);
+	git_inflate_init_gzip_only(&stream);
 
 	while (1) {
 		ssize_t n = xread(0, in_buf, sizeof(in_buf));
diff --git a/zlib.c b/zlib.c
index be9d7e9..b613cbd 100644
--- a/zlib.c
+++ b/zlib.c
@@ -32,6 +32,21 @@ void git_inflate_init(z_streamp strm)
 	    strm->msg ? strm->msg : "no message");
 }
 
+void git_inflate_init_gzip_only(z_streamp strm)
+{
+	/*
+	 * Use default 15 bits, +16 is to accept only gzip and to
+	 * yield Z_DATA_ERROR when fed zlib format.
+	 */
+	const int windowBits = 15 + 16;
+	int status = inflateInit2(strm, windowBits);
+
+	if (status == Z_OK)
+		return;
+	die("inflateInit2: %s (%s)", zerr_to_string(status),
+	    strm->msg ? strm->msg : "no message");
+}
+
 void git_inflate_end(z_streamp strm)
 {
 	int status = inflateEnd(strm);
-- 
1.7.6.rc1.118.ge175b4a

[PATCH 4/6] zlib: wrap deflate side of the API

[Junio C Hamano]

Wrap deflateInit, deflate, and deflateEnd for everybody, and the sole use
of deflateInit2 in remote-curl.c to tell the library to use gzip header
and trailer in git_deflate_init_gzip().

There is only one caller that cares about the status from deflateEnd().
Introduce git_deflate_end_gently() to let that sole caller retrieve the
status and act on it (i.e. die) for now, but we would probably want to
make inflate_end/deflate_end die when they ran out of memory and get
rid of the _gently() kind.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 archive-zip.c          |    6 ++--
 builtin/index-pack.c   |    6 ++--
 builtin/pack-objects.c |    6 ++--
 cache.h                |    6 ++++
 diff.c                 |    6 ++--
 fast-import.c          |   22 ++++++++--------
 http-push.c            |   12 ++++----
 remote-curl.c          |   10 ++-----
 sha1_file.c            |   10 ++++----
 zlib.c                 |   62 ++++++++++++++++++++++++++++++++++++++++++++++++
 10 files changed, 105 insertions(+), 41 deletions(-)

diff --git a/archive-zip.c b/archive-zip.c
index cf28504..081ff83 100644
--- a/archive-zip.c
+++ b/archive-zip.c
@@ -96,7 +96,7 @@ static void *zlib_deflate(void *data, unsigned long size,
 	int result;
 
 	memset(&stream, 0, sizeof(stream));
-	deflateInit(&stream, compression_level);
+	git_deflate_init(&stream, compression_level);
 	maxsize = deflateBound(&stream, size);
 	buffer = xmalloc(maxsize);
 
@@ -106,7 +106,7 @@ static void *zlib_deflate(void *data, unsigned long size,
 	stream.avail_out = maxsize;
 
 	do {
-		result = deflate(&stream, Z_FINISH);
+		result = git_deflate(&stream, Z_FINISH);
 	} while (result == Z_OK);
 
 	if (result != Z_STREAM_END) {
@@ -114,7 +114,7 @@ static void *zlib_deflate(void *data, unsigned long size,
 		return NULL;
 	}
 
-	deflateEnd(&stream);
+	git_deflate_end(&stream);
 	*compressed_size = stream.total_out;
 
 	return buffer;
diff --git a/builtin/index-pack.c b/builtin/index-pack.c
index 31f001f..dbfb5da 100644
--- a/builtin/index-pack.c
+++ b/builtin/index-pack.c
@@ -671,21 +671,21 @@ static int write_compressed(struct sha1file *f, void *in, unsigned int size)
 	unsigned char outbuf[4096];
 
 	memset(&stream, 0, sizeof(stream));
-	deflateInit(&stream, zlib_compression_level);
+	git_deflate_init(&stream, zlib_compression_level);
 	stream.next_in = in;
 	stream.avail_in = size;
 
 	do {
 		stream.next_out = outbuf;
 		stream.avail_out = sizeof(outbuf);
-		status = deflate(&stream, Z_FINISH);
+		status = git_deflate(&stream, Z_FINISH);
 		sha1write(f, outbuf, sizeof(outbuf) - stream.avail_out);
 	} while (status == Z_OK);
 
 	if (status != Z_STREAM_END)
 		die("unable to deflate appended object (%d)", status);
 	size = stream.total_out;
-	deflateEnd(&stream);
+	git_deflate_end(&stream);
 	return size;
 }
 
diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index f402a84..61f9755 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -131,7 +131,7 @@ static unsigned long do_compress(void **pptr, unsigned long size)
 	unsigned long maxsize;
 
 	memset(&stream, 0, sizeof(stream));
-	deflateInit(&stream, pack_compression_level);
+	git_deflate_init(&stream, pack_compression_level);
 	maxsize = deflateBound(&stream, size);
 
 	in = *pptr;
@@ -142,9 +142,9 @@ static unsigned long do_compress(void **pptr, unsigned long size)
 	stream.avail_in = size;
 	stream.next_out = out;
 	stream.avail_out = maxsize;
-	while (deflate(&stream, Z_FINISH) == Z_OK)
+	while (git_deflate(&stream, Z_FINISH) == Z_OK)
 		; /* nothing */
-	deflateEnd(&stream);
+	git_deflate_end(&stream);
 
 	free(in);
 	return stream.total_out;
diff --git a/cache.h b/cache.h
index 50f09d0..5eb61ac 100644
--- a/cache.h
+++ b/cache.h
@@ -25,6 +25,12 @@ void git_inflate_init_gzip_only(z_streamp strm);
 void git_inflate_end(z_streamp strm);
 int git_inflate(z_streamp strm, int flush);
 
+void git_deflate_init(z_streamp strm, int level);
+void git_deflate_init_gzip(z_streamp strm, int level);
+void git_deflate_end(z_streamp strm);
+int git_deflate_end_gently(z_streamp strm);
+int git_deflate(z_streamp strm, int flush);
+
 #if defined(DT_UNKNOWN) && !defined(NO_D_TYPE_IN_DIRENT)
 #define DTYPE(de)	((de)->d_type)
 #else
diff --git a/diff.c b/diff.c
index 559bf57..c15c70f 100644
--- a/diff.c
+++ b/diff.c
@@ -1732,7 +1732,7 @@ static unsigned char *deflate_it(char *data,
 	z_stream stream;
 
 	memset(&stream, 0, sizeof(stream));
-	deflateInit(&stream, zlib_compression_level);
+	git_deflate_init(&stream, zlib_compression_level);
 	bound = deflateBound(&stream, size);
 	deflated = xmalloc(bound);
 	stream.next_out = deflated;
@@ -1740,9 +1740,9 @@ static unsigned char *deflate_it(char *data,
 
 	stream.next_in = (unsigned char *)data;
 	stream.avail_in = size;
-	while (deflate(&stream, Z_FINISH) == Z_OK)
+	while (git_deflate(&stream, Z_FINISH) == Z_OK)
 		; /* nothing */
-	deflateEnd(&stream);
+	git_deflate_end(&stream);
 	*result_size = stream.total_out;
 	return deflated;
 }
diff --git a/fast-import.c b/fast-import.c
index 78d9786..42979e6 100644
--- a/fast-import.c
+++ b/fast-import.c
@@ -1050,7 +1050,7 @@ static int store_object(
 		delta = NULL;
 
 	memset(&s, 0, sizeof(s));
-	deflateInit(&s, pack_compression_level);
+	git_deflate_init(&s, pack_compression_level);
 	if (delta) {
 		s.next_in = delta;
 		s.avail_in = deltalen;
@@ -1060,9 +1060,9 @@ static int store_object(
 	}
 	s.avail_out = deflateBound(&s, s.avail_in);
 	s.next_out = out = xmalloc(s.avail_out);
-	while (deflate(&s, Z_FINISH) == Z_OK)
-		/* nothing */;
-	deflateEnd(&s);
+	while (git_deflate(&s, Z_FINISH) == Z_OK)
+		; /* nothing */
+	git_deflate_end(&s);
 
 	/* Determine if we should auto-checkpoint. */
 	if ((max_packsize && (pack_size + 60 + s.total_out) > max_packsize)
@@ -1078,14 +1078,14 @@ static int store_object(
 			delta = NULL;
 
 			memset(&s, 0, sizeof(s));
-			deflateInit(&s, pack_compression_level);
+			git_deflate_init(&s, pack_compression_level);
 			s.next_in = (void *)dat->buf;
 			s.avail_in = dat->len;
 			s.avail_out = deflateBound(&s, s.avail_in);
 			s.next_out = out = xrealloc(out, s.avail_out);
-			while (deflate(&s, Z_FINISH) == Z_OK)
-				/* nothing */;
-			deflateEnd(&s);
+			while (git_deflate(&s, Z_FINISH) == Z_OK)
+				; /* nothing */
+			git_deflate_end(&s);
 		}
 	}
 
@@ -1187,7 +1187,7 @@ static void stream_blob(uintmax_t len, unsigned char *sha1out, uintmax_t mark)
 	crc32_begin(pack_file);
 
 	memset(&s, 0, sizeof(s));
-	deflateInit(&s, pack_compression_level);
+	git_deflate_init(&s, pack_compression_level);
 
 	hdrlen = encode_in_pack_object_header(OBJ_BLOB, len, out_buf);
 	if (out_sz <= hdrlen)
@@ -1209,7 +1209,7 @@ static void stream_blob(uintmax_t len, unsigned char *sha1out, uintmax_t mark)
 			len -= n;
 		}
 
-		status = deflate(&s, len ? 0 : Z_FINISH);
+		status = git_deflate(&s, len ? 0 : Z_FINISH);
 
 		if (!s.avail_out || status == Z_STREAM_END) {
 			size_t n = s.next_out - out_buf;
@@ -1228,7 +1228,7 @@ static void stream_blob(uintmax_t len, unsigned char *sha1out, uintmax_t mark)
 			die("unexpected deflate failure: %d", status);
 		}
 	}
-	deflateEnd(&s);
+	git_deflate_end(&s);
 	git_SHA1_Final(sha1, &c);
 
 	if (sha1out)
diff --git a/http-push.c b/http-push.c
index d18346c..46e68c8 100644
--- a/http-push.c
+++ b/http-push.c
@@ -359,7 +359,7 @@ static void start_put(struct transfer_request *request)
 
 	/* Set it up */
 	memset(&stream, 0, sizeof(stream));
-	deflateInit(&stream, zlib_compression_level);
+	git_deflate_init(&stream, zlib_compression_level);
 	size = deflateBound(&stream, len + hdrlen);
 	strbuf_init(&request->buffer.buf, size);
 	request->buffer.posn = 0;
@@ -371,15 +371,15 @@ static void start_put(struct transfer_request *request)
 	/* First header.. */
 	stream.next_in = (void *)hdr;
 	stream.avail_in = hdrlen;
-	while (deflate(&stream, 0) == Z_OK)
-		/* nothing */;
+	while (git_deflate(&stream, 0) == Z_OK)
+		; /* nothing */
 
 	/* Then the data itself.. */
 	stream.next_in = unpacked;
 	stream.avail_in = len;
-	while (deflate(&stream, Z_FINISH) == Z_OK)
-		/* nothing */;
-	deflateEnd(&stream);
+	while (git_deflate(&stream, Z_FINISH) == Z_OK)
+		; /* nothing */
+	git_deflate_end(&stream);
 	free(unpacked);
 
 	request->buffer.buf.len = stream.total_out;
diff --git a/remote-curl.c b/remote-curl.c
index 775d614..3c7621a 100644
--- a/remote-curl.c
+++ b/remote-curl.c
@@ -475,11 +475,7 @@ static int post_rpc(struct rpc_state *rpc)
 		int ret;
 
 		memset(&stream, 0, sizeof(stream));
-		ret = deflateInit2(&stream, Z_BEST_COMPRESSION,
-				Z_DEFLATED, (15 + 16),
-				8, Z_DEFAULT_STRATEGY);
-		if (ret != Z_OK)
-			die("cannot deflate request; zlib init error %d", ret);
+		git_deflate_init_gzip(&stream, Z_BEST_COMPRESSION);
 		size = deflateBound(&stream, rpc->len);
 		gzip_body = xmalloc(size);
 
@@ -488,11 +484,11 @@ static int post_rpc(struct rpc_state *rpc)
 		stream.next_out = (unsigned char *)gzip_body;
 		stream.avail_out = size;
 
-		ret = deflate(&stream, Z_FINISH);
+		ret = git_deflate(&stream, Z_FINISH);
 		if (ret != Z_STREAM_END)
 			die("cannot deflate request; zlib deflate error %d", ret);
 
-		ret = deflateEnd(&stream);
+		ret = git_deflate_end_gently(&stream);
 		if (ret != Z_OK)
 			die("cannot deflate request; zlib end error %d", ret);
 
diff --git a/sha1_file.c b/sha1_file.c
index 1a7e410..0eefb61 100644
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -2442,7 +2442,7 @@ static int write_loose_object(const unsigned char *sha1, char *hdr, int hdrlen,
 
 	/* Set it up */
 	memset(&stream, 0, sizeof(stream));
-	deflateInit(&stream, zlib_compression_level);
+	git_deflate_init(&stream, zlib_compression_level);
 	stream.next_out = compressed;
 	stream.avail_out = sizeof(compressed);
 	git_SHA1_Init(&c);
@@ -2450,8 +2450,8 @@ static int write_loose_object(const unsigned char *sha1, char *hdr, int hdrlen,
 	/* First header.. */
 	stream.next_in = (unsigned char *)hdr;
 	stream.avail_in = hdrlen;
-	while (deflate(&stream, 0) == Z_OK)
-		/* nothing */;
+	while (git_deflate(&stream, 0) == Z_OK)
+		; /* nothing */
 	git_SHA1_Update(&c, hdr, hdrlen);
 
 	/* Then the data itself.. */
@@ -2459,7 +2459,7 @@ static int write_loose_object(const unsigned char *sha1, char *hdr, int hdrlen,
 	stream.avail_in = len;
 	do {
 		unsigned char *in0 = stream.next_in;
-		ret = deflate(&stream, Z_FINISH);
+		ret = git_deflate(&stream, Z_FINISH);
 		git_SHA1_Update(&c, in0, stream.next_in - in0);
 		if (write_buffer(fd, compressed, stream.next_out - compressed) < 0)
 			die("unable to write sha1 file");
@@ -2469,7 +2469,7 @@ static int write_loose_object(const unsigned char *sha1, char *hdr, int hdrlen,
 
 	if (ret != Z_STREAM_END)
 		die("unable to deflate new object %s (%d)", sha1_to_hex(sha1), ret);
-	ret = deflateEnd(&stream);
+	ret = git_deflate_end_gently(&stream);
 	if (ret != Z_OK)
 		die("deflateEnd on object %s failed (%d)", sha1_to_hex(sha1), ret);
 	git_SHA1_Final(parano_sha1, &c);
diff --git a/zlib.c b/zlib.c
index b613cbd..ee47a3a 100644
--- a/zlib.c
+++ b/zlib.c
@@ -77,3 +77,65 @@ int git_inflate(z_streamp strm, int flush)
 	      strm->msg ? strm->msg : "no message");
 	return status;
 }
+
+void git_deflate_init(z_streamp strm, int level)
+{
+	int status = deflateInit(strm, level);
+
+	if (status == Z_OK)
+		return;
+	die("deflateInit: %s (%s)", zerr_to_string(status),
+	    strm->msg ? strm->msg : "no message");
+}
+
+void git_deflate_init_gzip(z_streamp strm, int level)
+{
+	/*
+	 * Use default 15 bits, +16 is to generate gzip header/trailer
+	 * instead of the zlib wrapper.
+	 */
+	const int windowBits = 15 + 16;
+	int status = deflateInit2(strm, level,
+				  Z_DEFLATED, windowBits,
+				  8, Z_DEFAULT_STRATEGY);
+	if (status == Z_OK)
+		return;
+	die("deflateInit2: %s (%s)", zerr_to_string(status),
+	    strm->msg ? strm->msg : "no message");
+}
+
+void git_deflate_end(z_streamp strm)
+{
+	int status = deflateEnd(strm);
+
+	if (status == Z_OK)
+		return;
+	error("deflateEnd: %s (%s)", zerr_to_string(status),
+	      strm->msg ? strm->msg : "no message");
+}
+
+int git_deflate_end_gently(z_streamp strm)
+{
+	return deflateEnd(strm);
+}
+
+int git_deflate(z_streamp strm, int flush)
+{
+	int status = deflate(strm, flush);
+
+	switch (status) {
+	/* Z_BUF_ERROR: normal, needs more space in the output buffer */
+	case Z_BUF_ERROR:
+	case Z_OK:
+	case Z_STREAM_END:
+		return status;
+
+	case Z_MEM_ERROR:
+		die("deflate: out of memory");
+	default:
+		break;
+	}
+	error("deflate: %s (%s)", zerr_to_string(status),
+	      strm->msg ? strm->msg : "no message");
+	return status;
+}
-- 
1.7.6.rc1.118.ge175b4a

[PATCH 5/6] zlib: wrap deflateBound() too

[Junio C Hamano]

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 archive-zip.c          |    2 +-
 builtin/pack-objects.c |    2 +-
 cache.h                |    4 +---
 diff.c                 |    2 +-
 fast-import.c          |    4 ++--
 http-push.c            |    2 +-
 remote-curl.c          |    2 +-
 zlib.c                 |    9 +++++++++
 8 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/archive-zip.c b/archive-zip.c
index 081ff83..8fbac27 100644
--- a/archive-zip.c
+++ b/archive-zip.c
@@ -97,7 +97,7 @@ static void *zlib_deflate(void *data, unsigned long size,
 
 	memset(&stream, 0, sizeof(stream));
 	git_deflate_init(&stream, compression_level);
-	maxsize = deflateBound(&stream, size);
+	maxsize = git_deflate_bound(&stream, size);
 	buffer = xmalloc(maxsize);
 
 	stream.next_in = data;
diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index 61f9755..8981dd6 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -132,7 +132,7 @@ static unsigned long do_compress(void **pptr, unsigned long size)
 
 	memset(&stream, 0, sizeof(stream));
 	git_deflate_init(&stream, pack_compression_level);
-	maxsize = deflateBound(&stream, size);
+	maxsize = git_deflate_bound(&stream, size);
 
 	in = *pptr;
 	out = xmalloc(maxsize);
diff --git a/cache.h b/cache.h
index 5eb61ac..85ac5ec 100644
--- a/cache.h
+++ b/cache.h
@@ -16,9 +16,6 @@
 #endif
 
 #include <zlib.h>
-#if defined(NO_DEFLATE_BOUND) || ZLIB_VERNUM < 0x1200
-#define deflateBound(c,s)  ((s) + (((s) + 7) >> 3) + (((s) + 63) >> 6) + 11)
-#endif
 
 void git_inflate_init(z_streamp strm);
 void git_inflate_init_gzip_only(z_streamp strm);
@@ -30,6 +27,7 @@ void git_deflate_init_gzip(z_streamp strm, int level);
 void git_deflate_end(z_streamp strm);
 int git_deflate_end_gently(z_streamp strm);
 int git_deflate(z_streamp strm, int flush);
+unsigned long git_deflate_bound(z_streamp, unsigned long);
 
 #if defined(DT_UNKNOWN) && !defined(NO_D_TYPE_IN_DIRENT)
 #define DTYPE(de)	((de)->d_type)
diff --git a/diff.c b/diff.c
index c15c70f..bac9a4b 100644
--- a/diff.c
+++ b/diff.c
@@ -1733,7 +1733,7 @@ static unsigned char *deflate_it(char *data,
 
 	memset(&stream, 0, sizeof(stream));
 	git_deflate_init(&stream, zlib_compression_level);
-	bound = deflateBound(&stream, size);
+	bound = git_deflate_bound(&stream, size);
 	deflated = xmalloc(bound);
 	stream.next_out = deflated;
 	stream.avail_out = bound;
diff --git a/fast-import.c b/fast-import.c
index 42979e6..e4116a4 100644
--- a/fast-import.c
+++ b/fast-import.c
@@ -1058,7 +1058,7 @@ static int store_object(
 		s.next_in = (void *)dat->buf;
 		s.avail_in = dat->len;
 	}
-	s.avail_out = deflateBound(&s, s.avail_in);
+	s.avail_out = git_deflate_bound(&s, s.avail_in);
 	s.next_out = out = xmalloc(s.avail_out);
 	while (git_deflate(&s, Z_FINISH) == Z_OK)
 		; /* nothing */
@@ -1081,7 +1081,7 @@ static int store_object(
 			git_deflate_init(&s, pack_compression_level);
 			s.next_in = (void *)dat->buf;
 			s.avail_in = dat->len;
-			s.avail_out = deflateBound(&s, s.avail_in);
+			s.avail_out = git_deflate_bound(&s, s.avail_in);
 			s.next_out = out = xrealloc(out, s.avail_out);
 			while (git_deflate(&s, Z_FINISH) == Z_OK)
 				; /* nothing */
diff --git a/http-push.c b/http-push.c
index 46e68c8..ecd67cf 100644
--- a/http-push.c
+++ b/http-push.c
@@ -360,7 +360,7 @@ static void start_put(struct transfer_request *request)
 	/* Set it up */
 	memset(&stream, 0, sizeof(stream));
 	git_deflate_init(&stream, zlib_compression_level);
-	size = deflateBound(&stream, len + hdrlen);
+	size = git_deflate_bound(&stream, len + hdrlen);
 	strbuf_init(&request->buffer.buf, size);
 	request->buffer.posn = 0;
 
diff --git a/remote-curl.c b/remote-curl.c
index 3c7621a..13d8cee 100644
--- a/remote-curl.c
+++ b/remote-curl.c
@@ -476,7 +476,7 @@ static int post_rpc(struct rpc_state *rpc)
 
 		memset(&stream, 0, sizeof(stream));
 		git_deflate_init_gzip(&stream, Z_BEST_COMPRESSION);
-		size = deflateBound(&stream, rpc->len);
+		size = git_deflate_bound(&stream, rpc->len);
 		gzip_body = xmalloc(size);
 
 		stream.next_in = (unsigned char *)rpc->buf;
diff --git a/zlib.c b/zlib.c
index ee47a3a..8f19d2f 100644
--- a/zlib.c
+++ b/zlib.c
@@ -78,6 +78,15 @@ int git_inflate(z_streamp strm, int flush)
 	return status;
 }
 
+#if defined(NO_DEFLATE_BOUND) || ZLIB_VERNUM < 0x1200
+#define deflateBound(c,s)  ((s) + (((s) + 7) >> 3) + (((s) + 63) >> 6) + 11)
+#endif
+
+unsigned long git_deflate_bound(z_streamp strm, unsigned long size)
+{
+	return deflateBound(strm, size);
+}
+
 void git_deflate_init(z_streamp strm, int level)
 {
 	int status = deflateInit(strm, level);
-- 
1.7.6.rc1.118.ge175b4a

[PATCH 6/6] zlib: zlib can only process 4GB at a time

[Junio C Hamano]

The size of objects we read from the repository and data we try to put
into the repository are represented in "unsigned long", so that on larger
architectures we can handle objects that weigh more than 4GB.

But the interface defined in zlib.h to communicate with inflate/deflate
limits avail_in (how many bytes of input are we calling zlib with) and
avail_out (how many bytes of output from zlib are we ready to accept)
fields effectively to 4GB by defining their type to be uInt.

In many places in our code, we allocate a large buffer (e.g. mmap'ing a
large loose object file) and tell zlib its size by assigning the size to
avail_in field of the stream, but that will truncate the high octets of
the real size. The worst part of this story is that we often pass around
z_stream (the state object used by zlib) to keep track of the number of
used bytes in input/output buffer by inspecting these two fields, which
practically limits our callchain to the same 4GB limit.

Wrap z_stream in another structure git_zstream that can express avail_in
and avail_out in unsigned long. For now, just die() when the caller gives
a size that cannot be given to a single zlib call. In later patches in the
series, we would make git_inflate() and git_deflate() internally loop to
give callers an illusion that our "improved" version of zlib interface can
operate on a buffer larger than 4GB in one go.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 archive-zip.c            |    2 +-
 builtin/apply.c          |    2 +-
 builtin/index-pack.c     |    6 +-
 builtin/pack-objects.c   |   10 ++--
 builtin/unpack-objects.c |    2 +-
 cache.h                  |   35 +++++++++-----
 diff.c                   |    2 +-
 fast-import.c            |    4 +-
 http-backend.c           |    2 +-
 http-push.c              |    2 +-
 http.h                   |    2 +-
 pack-check.c             |    4 +-
 remote-curl.c            |    2 +-
 sha1_file.c              |   18 ++++----
 zlib.c                   |  119 +++++++++++++++++++++++++++++++++++-----------
 15 files changed, 142 insertions(+), 70 deletions(-)

diff --git a/archive-zip.c b/archive-zip.c
index 8fbac27..72d55a5 100644
--- a/archive-zip.c
+++ b/archive-zip.c
@@ -90,7 +90,7 @@ static void copy_le32(unsigned char *dest, unsigned int n)
 static void *zlib_deflate(void *data, unsigned long size,
 		int compression_level, unsigned long *compressed_size)
 {
-	z_stream stream;
+	git_zstream stream;
 	unsigned long maxsize;
 	void *buffer;
 	int result;
diff --git a/builtin/apply.c b/builtin/apply.c
index 530d4bb..f2edc52 100644
--- a/builtin/apply.c
+++ b/builtin/apply.c
@@ -1634,7 +1634,7 @@ static inline int metadata_changes(struct patch *patch)
 static char *inflate_it(const void *data, unsigned long size,
 			unsigned long inflated_size)
 {
-	z_stream stream;
+	git_zstream stream;
 	void *out;
 	int st;
 
diff --git a/builtin/index-pack.c b/builtin/index-pack.c
index dbfb5da..f65cb37 100644
--- a/builtin/index-pack.c
+++ b/builtin/index-pack.c
@@ -265,7 +265,7 @@ static void unlink_base_data(struct base_data *c)
 static void *unpack_entry_data(unsigned long offset, unsigned long size)
 {
 	int status;
-	z_stream stream;
+	git_zstream stream;
 	void *buf = xmalloc(size);
 
 	memset(&stream, 0, sizeof(stream));
@@ -355,7 +355,7 @@ static void *get_data_from_pack(struct object_entry *obj)
 	off_t from = obj[0].idx.offset + obj[0].hdr_size;
 	unsigned long len = obj[1].idx.offset - from;
 	unsigned char *data, *inbuf;
-	z_stream stream;
+	git_zstream stream;
 	int status;
 
 	data = xmalloc(obj->size);
@@ -666,7 +666,7 @@ static void parse_pack_objects(unsigned char *sha1)
 
 static int write_compressed(struct sha1file *f, void *in, unsigned int size)
 {
-	z_stream stream;
+	git_zstream stream;
 	int status;
 	unsigned char outbuf[4096];
 
diff --git a/builtin/pack-objects.c b/builtin/pack-objects.c
index 8981dd6..c6e2d87 100644
--- a/builtin/pack-objects.c
+++ b/builtin/pack-objects.c
@@ -126,7 +126,7 @@ static void *get_delta(struct object_entry *entry)
 
 static unsigned long do_compress(void **pptr, unsigned long size)
 {
-	z_stream stream;
+	git_zstream stream;
 	void *in, *out;
 	unsigned long maxsize;
 
@@ -160,7 +160,7 @@ static int check_pack_inflate(struct packed_git *p,
 		off_t len,
 		unsigned long expect)
 {
-	z_stream stream;
+	git_zstream stream;
 	unsigned char fakebuf[4096], *in;
 	int st;
 
@@ -187,12 +187,12 @@ static void copy_pack_data(struct sha1file *f,
 		off_t len)
 {
 	unsigned char *in;
-	unsigned int avail;
+	unsigned long avail;
 
 	while (len) {
 		in = use_pack(p, w_curs, offset, &avail);
 		if (avail > len)
-			avail = (unsigned int)len;
+			avail = (unsigned long)len;
 		sha1write(f, in, avail);
 		offset += avail;
 		len -= avail;
@@ -994,7 +994,7 @@ static void check_object(struct object_entry *entry)
 		const unsigned char *base_ref = NULL;
 		struct object_entry *base_entry;
 		unsigned long used, used_0;
-		unsigned int avail;
+		unsigned long avail;
 		off_t ofs;
 		unsigned char *buf, c;
 
diff --git a/builtin/unpack-objects.c b/builtin/unpack-objects.c
index f63973c..14e04e6 100644
--- a/builtin/unpack-objects.c
+++ b/builtin/unpack-objects.c
@@ -90,7 +90,7 @@ static void use(int bytes)
 
 static void *get_data(unsigned long size)
 {
-	z_stream stream;
+	git_zstream stream;
 	void *buf = xmalloc(size);
 
 	memset(&stream, 0, sizeof(stream));
diff --git a/cache.h b/cache.h
index 85ac5ec..1784bab 100644
--- a/cache.h
+++ b/cache.h
@@ -16,18 +16,27 @@
 #endif
 
 #include <zlib.h>
-
-void git_inflate_init(z_streamp strm);
-void git_inflate_init_gzip_only(z_streamp strm);
-void git_inflate_end(z_streamp strm);
-int git_inflate(z_streamp strm, int flush);
-
-void git_deflate_init(z_streamp strm, int level);
-void git_deflate_init_gzip(z_streamp strm, int level);
-void git_deflate_end(z_streamp strm);
-int git_deflate_end_gently(z_streamp strm);
-int git_deflate(z_streamp strm, int flush);
-unsigned long git_deflate_bound(z_streamp, unsigned long);
+typedef struct git_zstream {
+	z_stream z;
+	unsigned long avail_in;
+	unsigned long avail_out;
+	unsigned long total_in;
+	unsigned long total_out;
+	unsigned char *next_in;
+	unsigned char *next_out;
+} git_zstream;
+
+void git_inflate_init(git_zstream *);
+void git_inflate_init_gzip_only(git_zstream *);
+void git_inflate_end(git_zstream *);
+int git_inflate(git_zstream *, int flush);
+
+void git_deflate_init(git_zstream *, int level);
+void git_deflate_init_gzip(git_zstream *, int level);
+void git_deflate_end(git_zstream *);
+int git_deflate_end_gently(git_zstream *);
+int git_deflate(git_zstream *, int flush);
+unsigned long git_deflate_bound(git_zstream *, unsigned long);
 
 #if defined(DT_UNKNOWN) && !defined(NO_D_TYPE_IN_DIRENT)
 #define DTYPE(de)	((de)->d_type)
@@ -991,7 +1000,7 @@ extern struct packed_git *find_sha1_pack(const unsigned char *sha1,
 extern void pack_report(void);
 extern int open_pack_index(struct packed_git *);
 extern void close_pack_index(struct packed_git *);
-extern unsigned char *use_pack(struct packed_git *, struct pack_window **, off_t, unsigned int *);
+extern unsigned char *use_pack(struct packed_git *, struct pack_window **, off_t, unsigned long *);
 extern void close_pack_windows(struct packed_git *);
 extern void unuse_pack(struct pack_window **);
 extern void free_pack_by_name(const char *);
diff --git a/diff.c b/diff.c
index bac9a4b..431873d 100644
--- a/diff.c
+++ b/diff.c
@@ -1729,7 +1729,7 @@ static unsigned char *deflate_it(char *data,
 {
 	int bound;
 	unsigned char *deflated;
-	z_stream stream;
+	git_zstream stream;
 
 	memset(&stream, 0, sizeof(stream));
 	git_deflate_init(&stream, zlib_compression_level);
diff --git a/fast-import.c b/fast-import.c
index e4116a4..1d5e333 100644
--- a/fast-import.c
+++ b/fast-import.c
@@ -1017,7 +1017,7 @@ static int store_object(
 	unsigned char sha1[20];
 	unsigned long hdrlen, deltalen;
 	git_SHA_CTX c;
-	z_stream s;
+	git_zstream s;
 
 	hdrlen = sprintf((char *)hdr,"%s %lu", typename(type),
 		(unsigned long)dat->len) + 1;
@@ -1163,7 +1163,7 @@ static void stream_blob(uintmax_t len, unsigned char *sha1out, uintmax_t mark)
 	off_t offset;
 	git_SHA_CTX c;
 	git_SHA_CTX pack_file_ctx;
-	z_stream s;
+	git_zstream s;
 	int status = Z_OK;
 
 	/* Determine if we should auto-checkpoint. */
diff --git a/http-backend.c b/http-backend.c
index ab5015d..59ad7da 100644
--- a/http-backend.c
+++ b/http-backend.c
@@ -271,7 +271,7 @@ static struct rpc_service *select_service(const char *name)
 
 static void inflate_request(const char *prog_name, int out)
 {
-	z_stream stream;
+	git_zstream stream;
 	unsigned char in_buf[8192];
 	unsigned char out_buf[8192];
 	unsigned long cnt = 0;
diff --git a/http-push.c b/http-push.c
index ecd67cf..1e8a830 100644
--- a/http-push.c
+++ b/http-push.c
@@ -352,7 +352,7 @@ static void start_put(struct transfer_request *request)
 	unsigned long len;
 	int hdrlen;
 	ssize_t size;
-	z_stream stream;
+	git_zstream stream;
 
 	unpacked = read_sha1_file(request->obj->sha1, &type, &len);
 	hdrlen = sprintf(hdr, "%s %lu", typename(type), len) + 1;
diff --git a/http.h b/http.h
index e9ed3c2..a39304a 100644
--- a/http.h
+++ b/http.h
@@ -172,7 +172,7 @@ struct http_object_request {
 	unsigned char sha1[20];
 	unsigned char real_sha1[20];
 	git_SHA_CTX c;
-	z_stream stream;
+	git_zstream stream;
 	int zret;
 	int rename;
 	struct active_request_slot *slot;
diff --git a/pack-check.c b/pack-check.c
index a1a5216..0c19b6e 100644
--- a/pack-check.c
+++ b/pack-check.c
@@ -26,7 +26,7 @@ int check_pack_crc(struct packed_git *p, struct pack_window **w_curs,
 	uint32_t data_crc = crc32(0, NULL, 0);
 
 	do {
-		unsigned int avail;
+		unsigned long avail;
 		void *data = use_pack(p, w_curs, offset, &avail);
 		if (avail > len)
 			avail = len;
@@ -61,7 +61,7 @@ static int verify_packfile(struct packed_git *p,
 
 	git_SHA1_Init(&ctx);
 	do {
-		unsigned int remaining;
+		unsigned long remaining;
 		unsigned char *in = use_pack(p, w_curs, offset, &remaining);
 		offset += remaining;
 		if (!pack_sig_ofs)
diff --git a/remote-curl.c b/remote-curl.c
index 13d8cee..bc48a36 100644
--- a/remote-curl.c
+++ b/remote-curl.c
@@ -471,7 +471,7 @@ static int post_rpc(struct rpc_state *rpc)
 		 * the transfer time.
 		 */
 		size_t size;
-		z_stream stream;
+		git_zstream stream;
 		int ret;
 
 		memset(&stream, 0, sizeof(stream));
diff --git a/sha1_file.c b/sha1_file.c
index 0eefb61..94d4319 100644
--- a/sha1_file.c
+++ b/sha1_file.c
@@ -833,7 +833,7 @@ static int in_window(struct pack_window *win, off_t offset)
 unsigned char *use_pack(struct packed_git *p,
 		struct pack_window **w_cursor,
 		off_t offset,
-		unsigned int *left)
+		unsigned long *left)
 {
 	struct pack_window *win = *w_cursor;
 
@@ -1244,7 +1244,7 @@ unsigned long unpack_object_header_buffer(const unsigned char *buf,
 	return used;
 }
 
-static int unpack_sha1_header(z_stream *stream, unsigned char *map, unsigned long mapsize, void *buffer, unsigned long bufsiz)
+static int unpack_sha1_header(git_zstream *stream, unsigned char *map, unsigned long mapsize, void *buffer, unsigned long bufsiz)
 {
 	unsigned long size, used;
 	static const char valid_loose_object_type[8] = {
@@ -1291,7 +1291,7 @@ static int unpack_sha1_header(z_stream *stream, unsigned char *map, unsigned lon
 	return 0;
 }
 
-static void *unpack_sha1_rest(z_stream *stream, void *buffer, unsigned long size, const unsigned char *sha1)
+static void *unpack_sha1_rest(git_zstream *stream, void *buffer, unsigned long size, const unsigned char *sha1)
 {
 	int bytes = strlen(buffer) + 1;
 	unsigned char *buf = xmallocz(size);
@@ -1390,7 +1390,7 @@ static int parse_sha1_header(const char *hdr, unsigned long *sizep)
 static void *unpack_sha1_file(void *map, unsigned long mapsize, enum object_type *type, unsigned long *size, const unsigned char *sha1)
 {
 	int ret;
-	z_stream stream;
+	git_zstream stream;
 	char hdr[8192];
 
 	ret = unpack_sha1_header(&stream, map, mapsize, hdr, sizeof(hdr));
@@ -1406,7 +1406,7 @@ unsigned long get_size_from_delta(struct packed_git *p,
 {
 	const unsigned char *data;
 	unsigned char delta_head[20], *in;
-	z_stream stream;
+	git_zstream stream;
 	int st;
 
 	memset(&stream, 0, sizeof(stream));
@@ -1528,7 +1528,7 @@ static int unpack_object_header(struct packed_git *p,
 				unsigned long *sizep)
 {
 	unsigned char *base;
-	unsigned int left;
+	unsigned long left;
 	unsigned long used;
 	enum object_type type;
 
@@ -1641,7 +1641,7 @@ static void *unpack_compressed_entry(struct packed_git *p,
 				    unsigned long size)
 {
 	int st;
-	z_stream stream;
+	git_zstream stream;
 	unsigned char *buffer, *in;
 
 	buffer = xmallocz(size);
@@ -2074,7 +2074,7 @@ static int sha1_loose_object_info(const unsigned char *sha1, unsigned long *size
 	int status;
 	unsigned long mapsize, size;
 	void *map;
-	z_stream stream;
+	git_zstream stream;
 	char hdr[32];
 
 	map = map_sha1_file(sha1, &mapsize);
@@ -2425,7 +2425,7 @@ static int write_loose_object(const unsigned char *sha1, char *hdr, int hdrlen,
 {
 	int fd, ret;
 	unsigned char compressed[4096];
-	z_stream stream;
+	git_zstream stream;
 	git_SHA_CTX c;
 	unsigned char parano_sha1[20];
 	char *filename;
diff --git a/zlib.c b/zlib.c
index 8f19d2f..fe537e3 100644
--- a/zlib.c
+++ b/zlib.c
@@ -22,45 +22,90 @@ static const char *zerr_to_string(int status)
 	}
 }
 
-void git_inflate_init(z_streamp strm)
+/*
+ * avail_in and avail_out in zlib are counted in uInt, which typically
+ * limits the size of the buffer we can use to 4GB when interacting
+ * with zlib in a single call to inflate/deflate.
+ */
+#define ZLIB_BUF_MAX ((uInt)-1)
+static inline uInt zlib_buf_cap(unsigned long len)
+{
+	if (ZLIB_BUF_MAX < len)
+		die("working buffer for zlib too large");
+	return len;
+}
+
+static void zlib_pre_call(git_zstream *s)
+{
+	s->z.next_in = s->next_in;
+	s->z.next_out = s->next_out;
+	s->z.total_in = s->total_in;
+	s->z.total_out = s->total_out;
+	s->z.avail_in = zlib_buf_cap(s->avail_in);
+	s->z.avail_out = zlib_buf_cap(s->avail_out);
+}
+
+static void zlib_post_call(git_zstream *s)
+{
+	s->next_in = s->z.next_in;
+	s->next_out = s->z.next_out;
+	s->total_in = s->z.total_in;
+	s->total_out = s->z.total_out;
+	s->avail_in = s->z.avail_in;
+	s->avail_out = s->z.avail_out;
+}
+
+void git_inflate_init(git_zstream *strm)
 {
-	int status = inflateInit(strm);
+	int status;
 
+	zlib_pre_call(strm);
+	status = inflateInit(&strm->z);
+	zlib_post_call(strm);
 	if (status == Z_OK)
 		return;
 	die("inflateInit: %s (%s)", zerr_to_string(status),
-	    strm->msg ? strm->msg : "no message");
+	    strm->z.msg ? strm->z.msg : "no message");
 }
 
-void git_inflate_init_gzip_only(z_streamp strm)
+void git_inflate_init_gzip_only(git_zstream *strm)
 {
 	/*
 	 * Use default 15 bits, +16 is to accept only gzip and to
 	 * yield Z_DATA_ERROR when fed zlib format.
 	 */
 	const int windowBits = 15 + 16;
-	int status = inflateInit2(strm, windowBits);
+	int status;
 
+	zlib_pre_call(strm);
+	status = inflateInit2(&strm->z, windowBits);
+	zlib_post_call(strm);
 	if (status == Z_OK)
 		return;
 	die("inflateInit2: %s (%s)", zerr_to_string(status),
-	    strm->msg ? strm->msg : "no message");
+	    strm->z.msg ? strm->z.msg : "no message");
 }
 
-void git_inflate_end(z_streamp strm)
+void git_inflate_end(git_zstream *strm)
 {
-	int status = inflateEnd(strm);
+	int status;
 
+	zlib_pre_call(strm);
+	status = inflateEnd(&strm->z);
+	zlib_post_call(strm);
 	if (status == Z_OK)
 		return;
 	error("inflateEnd: %s (%s)", zerr_to_string(status),
-	      strm->msg ? strm->msg : "no message");
+	      strm->z.msg ? strm->z.msg : "no message");
 }
 
-int git_inflate(z_streamp strm, int flush)
+int git_inflate(git_zstream *strm, int flush)
 {
-	int status = inflate(strm, flush);
+	int status;
 
+	zlib_pre_call(strm);
+	status = inflate(&strm->z, flush);
+	zlib_post_call(strm);
 	switch (status) {
 	/* Z_BUF_ERROR: normal, needs more space in the output buffer */
 	case Z_BUF_ERROR:
@@ -74,7 +119,7 @@ int git_inflate(z_streamp strm, int flush)
 		break;
 	}
 	error("inflate: %s (%s)", zerr_to_string(status),
-	      strm->msg ? strm->msg : "no message");
+	      strm->z.msg ? strm->z.msg : "no message");
 	return status;
 }
 
@@ -82,56 +127,74 @@ int git_inflate(z_streamp strm, int flush)
 #define deflateBound(c,s)  ((s) + (((s) + 7) >> 3) + (((s) + 63) >> 6) + 11)
 #endif
 
-unsigned long git_deflate_bound(z_streamp strm, unsigned long size)
+unsigned long git_deflate_bound(git_zstream *strm, unsigned long size)
 {
-	return deflateBound(strm, size);
+	return deflateBound(&strm->z, size);
 }
 
-void git_deflate_init(z_streamp strm, int level)
+void git_deflate_init(git_zstream *strm, int level)
 {
-	int status = deflateInit(strm, level);
+	int status;
 
+	zlib_pre_call(strm);
+	status = deflateInit(&strm->z, level);
+	zlib_post_call(strm);
 	if (status == Z_OK)
 		return;
 	die("deflateInit: %s (%s)", zerr_to_string(status),
-	    strm->msg ? strm->msg : "no message");
+	    strm->z.msg ? strm->z.msg : "no message");
 }
 
-void git_deflate_init_gzip(z_streamp strm, int level)
+void git_deflate_init_gzip(git_zstream *strm, int level)
 {
 	/*
 	 * Use default 15 bits, +16 is to generate gzip header/trailer
 	 * instead of the zlib wrapper.
 	 */
 	const int windowBits = 15 + 16;
-	int status = deflateInit2(strm, level,
+	int status;
+
+	zlib_pre_call(strm);
+	status = deflateInit2(&strm->z, level,
 				  Z_DEFLATED, windowBits,
 				  8, Z_DEFAULT_STRATEGY);
+	zlib_post_call(strm);
 	if (status == Z_OK)
 		return;
 	die("deflateInit2: %s (%s)", zerr_to_string(status),
-	    strm->msg ? strm->msg : "no message");
+	    strm->z.msg ? strm->z.msg : "no message");
 }
 
-void git_deflate_end(z_streamp strm)
+void git_deflate_end(git_zstream *strm)
 {
-	int status = deflateEnd(strm);
+	int status;
 
+	zlib_pre_call(strm);
+	status = deflateEnd(&strm->z);
+	zlib_post_call(strm);
 	if (status == Z_OK)
 		return;
 	error("deflateEnd: %s (%s)", zerr_to_string(status),
-	      strm->msg ? strm->msg : "no message");
+	      strm->z.msg ? strm->z.msg : "no message");
 }
 
-int git_deflate_end_gently(z_streamp strm)
+int git_deflate_end_gently(git_zstream *strm)
 {
-	return deflateEnd(strm);
+	int status;
+
+	zlib_pre_call(strm);
+	status = deflateEnd(&strm->z);
+	zlib_post_call(strm);
+	return status;
 }
 
-int git_deflate(z_streamp strm, int flush)
+int git_deflate(git_zstream *strm, int flush)
 {
-	int status = deflate(strm, flush);
+	int status;
 
+	zlib_pre_call(strm);
+	status = deflate(&strm->z, flush);
+	zlib_post_call(strm);
 	switch (status) {
 	/* Z_BUF_ERROR: normal, needs more space in the output buffer */
 	case Z_BUF_ERROR:
@@ -145,6 +208,6 @@ int git_deflate(z_streamp strm, int flush)
 		break;
 	}
 	error("deflate: %s (%s)", zerr_to_string(status),
-	      strm->msg ? strm->msg : "no message");
+	      strm->z.msg ? strm->z.msg : "no message");
 	return status;
 }
-- 
1.7.6.rc1.118.ge175b4a

Re: [PATCH 4/6] zlib: wrap deflate side of the API

[Thiago Farina]

On Fri, Jun 10, 2011 at 5:15 PM, Junio C Hamano <gitster@pobox.com> wrote:
> +void git_deflate_init_gzip(z_streamp strm, int level)
> +{
> +       /*
> +        * Use default 15 bits, +16 is to generate gzip header/trailer
> +        * instead of the zlib wrapper.
> +        */
> +       const int windowBits = 15 + 16;
Was this style intentional?

Re: [PATCH 4/6] zlib: wrap deflate side of the API

[Junio C Hamano]

Thiago Farina <tfransosi@gmail.com> writes:

> On Fri, Jun 10, 2011 at 5:15 PM, Junio C Hamano <gitster@pobox.com> wrote:
>> +void git_deflate_init_gzip(z_streamp strm, int level)
>> +{
>> +       /*
>> +        * Use default 15 bits, +16 is to generate gzip header/trailer
>> +        * instead of the zlib wrapper.
>> +        */
>> +       const int windowBits = 15 + 16;
> Was this style intentional?

Sorry, but what style specifically do you find questionable?

[PATCH 7/6] zlib: allow feeding more than 4GB in one go

[Junio C Hamano]

Junio C Hamano <gitster@pobox.com> writes:

> The next step would be to tweak zlib_post_call(), git_inflate() and
> git_deflate() functions to internally loop and call underlying inflate()
> and deflate() when the incoming buffers are larger than 4GB, but that
> part is not done in this series (yet).

And this is such a patch.

I had a draft of this one ready when I sent the previous 6-patch series,
but it took embarrassingly long time for me to figure out what went wrong
in this patch before I realized that Z_FINISH should not be relayed to the
underlying inflate/deflate if we are splitting the request into multiple
phases.

I consider it still rough, but with this on top of v1.7.5.4, together with
the previous 6 patches, it seems to pass a trivial "have a large blob,
add, commit, pack, verify, index-pack, fsck" tests, without using either
of the recent "let's pass large blob to fast-import" (in 'master') nor
"let's stream a blob out without expanding it in core first" (in 'next')
changes.

-- test script to be stored in /var/tmp/junk or somewhere --
#!/bin/sh

set -x

rm -fr .git && git init || exit

echo | dd bs=1M seek=4800 of=a.big
sleep 2
git add a.big

eval $(git ls-files -s a.big |
    sed -e 's/^[0-7]* \([0-9a-f][0-9a-f]\)\([0-9a-f]*\) .*/h=\1 a=\2/')
echo $h $a

ls -l .git/objects/$h/$a || exit

git commit -m initial || exit

git fsck || exit

git repack -a -d || exit

git fsck || exit

f=$(find .git/objects/?? -type f)
test -z "$f" || exit

p=$(find .git/objects/pack -type f -name '*.pack') &&
i=${p%.pack}.idx &&

test -f $p &&
test -f $i || exit

mv $p $i . &&
pp=$(basename $p) &&
ii=$(basename $i) &&
test -f $pp &&
test -f $ii || exit

git verify-pack $pp || exit

git unpack-objects <$pp || exit

ls -l .git/objects/$h/$a || exit

rm -fr .git/objects/?? || exit

git index-pack --stdin <$pp || exit
test -f "$i" || exit
cmp $i $ii || exit

git cat-file blob "$h$a" >b.big || exit
cmp a.big b.big

echo all done.
exit 0
-- test script ends here --

-- >8 --
Update zlib_post_call() that adjusts the wrapper's notion of avail_in and
avail_out to what came back from zlib, so that the callers can feed
buffers larger than than 4GB to the API.

When underlying inflate/deflate stopped processing because we fed a buffer
larger than 4GB limit, detect that case, update the state variables, and
let the zlib function work another round.

Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 zlib.c |   78 +++++++++++++++++++++++++++++++++++++++++++++++----------------
 1 files changed, 58 insertions(+), 20 deletions(-)

diff --git a/zlib.c b/zlib.c
index fe537e3..3c63d48 100644
--- a/zlib.c
+++ b/zlib.c
@@ -27,12 +27,11 @@ static const char *zerr_to_string(int status)
  * limits the size of the buffer we can use to 4GB when interacting
  * with zlib in a single call to inflate/deflate.
  */
-#define ZLIB_BUF_MAX ((uInt)-1)
+/* #define ZLIB_BUF_MAX ((uInt)-1) */
+#define ZLIB_BUF_MAX ((uInt) 1024 * 1024 * 1024) /* 1GB */
 static inline uInt zlib_buf_cap(unsigned long len)
 {
-	if (ZLIB_BUF_MAX < len)
-		die("working buffer for zlib too large");
-	return len;
+	return (ZLIB_BUF_MAX < len) ? ZLIB_BUF_MAX : len;
 }
 
 static void zlib_pre_call(git_zstream *s)
@@ -47,12 +46,22 @@ static void zlib_pre_call(git_zstream *s)
 
 static void zlib_post_call(git_zstream *s)
 {
+	unsigned long bytes_consumed;
+	unsigned long bytes_produced;
+
+	bytes_consumed = s->z.next_in - s->next_in;
+	bytes_produced = s->z.next_out - s->next_out;
+	if (s->z.total_out != s->total_out + bytes_produced)
+		die("BUG: total_out mismatch");
+	if (s->z.total_in != s->total_in + bytes_consumed)
+		die("BUG: total_in mismatch");
+
+	s->total_out = s->z.total_out;
+	s->total_in = s->z.total_in;
 	s->next_in = s->z.next_in;
 	s->next_out = s->z.next_out;
-	s->total_in = s->z.total_in;
-	s->total_out = s->z.total_out;
-	s->avail_in = s->z.avail_in;
-	s->avail_out = s->z.avail_out;
+	s->avail_in -= bytes_consumed;
+	s->avail_out -= bytes_produced;
 }
 
 void git_inflate_init(git_zstream *strm)
@@ -103,18 +112,32 @@ int git_inflate(git_zstream *strm, int flush)
 {
 	int status;
 
-	zlib_pre_call(strm);
-	status = inflate(&strm->z, flush);
-	zlib_post_call(strm);
+	for (;;) {
+		zlib_pre_call(strm);
+		/* Never say Z_FINISH unless we are feeding everything */
+		status = inflate(&strm->z,
+				 (strm->z.avail_in != strm->avail_in)
+				 ? 0 : flush);
+		if (status == Z_MEM_ERROR)
+			die("inflate: out of memory");
+		zlib_post_call(strm);
+
+		/*
+		 * Let zlib work another round, while we can still
+		 * make progress.
+		 */
+		if ((strm->avail_out && !strm->z.avail_out) &&
+		    (status == Z_OK || status == Z_BUF_ERROR))
+			continue;
+		break;
+	}
+
 	switch (status) {
 	/* Z_BUF_ERROR: normal, needs more space in the output buffer */
 	case Z_BUF_ERROR:
 	case Z_OK:
 	case Z_STREAM_END:
 		return status;
-
-	case Z_MEM_ERROR:
-		die("inflate: out of memory");
 	default:
 		break;
 	}
@@ -192,18 +215,33 @@ int git_deflate(git_zstream *strm, int flush)
 {
 	int status;
 
-	zlib_pre_call(strm);
-	status = deflate(&strm->z, flush);
-	zlib_post_call(strm);
+	for (;;) {
+		zlib_pre_call(strm);
+
+		/* Never say Z_FINISH unless we are feeding everything */
+		status = deflate(&strm->z,
+				 (strm->z.avail_in != strm->avail_in)
+				 ? 0 : flush);
+		if (status == Z_MEM_ERROR)
+			die("deflate: out of memory");
+		zlib_post_call(strm);
+
+		/*
+		 * Let zlib work another round, while we can still
+		 * make progress.
+		 */
+		if ((strm->avail_out && !strm->z.avail_out) &&
+		    (status == Z_OK || status == Z_BUF_ERROR))
+			continue;
+		break;
+	}
+
 	switch (status) {
 	/* Z_BUF_ERROR: normal, needs more space in the output buffer */
 	case Z_BUF_ERROR:
 	case Z_OK:
 	case Z_STREAM_END:
 		return status;
-
-	case Z_MEM_ERROR:
-		die("deflate: out of memory");
 	default:
 		break;
 	}
-- 
1.7.6.rc1.118.ge175b4a

Re: [PATCH 6/6] zlib: zlib can only process 4GB at a time

[Erik Faye-Lund]

On Fri, Jun 10, 2011 at 10:15 PM, Junio C Hamano <gitster@pobox.com> wrote:
> The size of objects we read from the repository and data we try to put
> into the repository are represented in "unsigned long", so that on larger
> architectures we can handle objects that weigh more than 4GB.

shouldn't this be "size_t" instead of "unsigned long"? "unsigned long"
is 32bit on Win64, whereas size_t is 64bit:

http://msdn.microsoft.com/en-us/library/s3f49ktz(v=vs.80).aspx
http://msdn.microsoft.com/en-us/library/aa384083(VS.85).aspx

Re: [PATCH 6/6] zlib: zlib can only process 4GB at a time

[Junio C Hamano]

Erik Faye-Lund <kusmabite@gmail.com> writes:

> On Fri, Jun 10, 2011 at 10:15 PM, Junio C Hamano <gitster@pobox.com> wrote:
>> The size of objects we read from the repository and data we try to put
>> into the repository are represented in "unsigned long", so that on larger
>> architectures we can handle objects that weigh more than 4GB.
>
> shouldn't this be "size_t" instead of "unsigned long"?

No, this must be unsigned long as that is the internal type we use.

Implementation of git on 32-bit platforms has always been limited to 4GB
from day one. This topic is not about changing it.

Re: [PATCH 6/6] zlib: zlib can only process 4GB at a time

[Matthieu Moy]

Junio C Hamano <gitster@pobox.com> writes:

> Implementation of git on 32-bit platforms has always been limited to 4GB
> from day one. This topic is not about changing it.

Erik's remark was about Win64, not about 32-bit.

-- 
Matthieu Moy
http://www-verimag.imag.fr/~moy/

Re: [PATCH 6/6] zlib: zlib can only process 4GB at a time

[Erik Faye-Lund]

On Sun, Jun 12, 2011 at 11:33 PM, Junio C Hamano <gitster@pobox.com> wrote:
> Erik Faye-Lund <kusmabite@gmail.com> writes:
>
>> On Fri, Jun 10, 2011 at 10:15 PM, Junio C Hamano <gitster@pobox.com> wrote:
>>> The size of objects we read from the repository and data we try to put
>>> into the repository are represented in "unsigned long", so that on larger
>>> architectures we can handle objects that weigh more than 4GB.
>>
>> shouldn't this be "size_t" instead of "unsigned long"?
>
> No, this must be unsigned long as that is the internal type we use.

I'm not sure I even understand what you mean here. "unsigned long" is
the only choice because it's the type we use? That's sounds pretty
close to tautology to my ears.

Looking a bit more at the code, it seems that we currently use
"unsigned long" a lot of places where "size_t" should have been used.
And this series is about changing places where "unsigned int" is being
used instead of "unsigned long". This sounds backwards to me;
shouldn't all code that deals with sizes (both the ones that are
"unsigned int" AND the ones that are "unsigned long") be changed to
size_t instead?

> Implementation of git on 32-bit platforms has always been limited to 4GB
> from day one. This topic is not about changing it.

As Matthieu pointed out, my comment wasn't about 32-bit systems;
"unsigned long" is 32-bit even on 64-bit versions on Windows. I
believe TortoiseGit builds Git for Windows as 64-bit, so AFAIK this
would still be a problem for them.

Re: [PATCH 6/6] zlib: zlib can only process 4GB at a time

[Jonathan Nieder]

Erik Faye-Lund wrote:

> Looking a bit more at the code, it seems that we currently use
> "unsigned long" a lot of places where "size_t" should have been used.

As Junio's comment about 32-bit platforms hints, when it comes to be
the time to change all those places, wouldn't off_t be a better
choice?

Thanks --- it is exciting to watch this topic move forward, inch by
inch.  And thanks for the hint about invalid word size == sizeof(long)
assumptions on Windows.

Re: [PATCH 6/6] zlib: zlib can only process 4GB at a time

[Junio C Hamano]

Erik Faye-Lund <kusmabite@gmail.com> writes:

> On Sun, Jun 12, 2011 at 11:33 PM, Junio C Hamano <gitster@pobox.com> wrote:
>> Erik Faye-Lund <kusmabite@gmail.com> writes:
>>
>>> On Fri, Jun 10, 2011 at 10:15 PM, Junio C Hamano <gitster@pobox.com> wrote:
>>>> The size of objects we read from the repository and data we try to put
>>>> into the repository are represented in "unsigned long", so that on larger
>>>> architectures we can handle objects that weigh more than 4GB.
>>>
>>> shouldn't this be "size_t" instead of "unsigned long"?
>>
>> No, this must be unsigned long as that is the internal type we use.

There are two unrelated issues you have to address if your "unsigned long"
is 32-bit and you want to handle more than 4GB data in git.

When git holds repository data in core, it always has represented it as a
pair of <pointer to the beginning of memory block that holds data, length>
where the length is "unsigned long" from day one.  See read_sha1_file() in
read-cache.c that appears in e83c516 (Initial revision of "git", the
information manager from hell, 2005-04-07). This limits you to 4GB if your
"unsigned long" is 32-bit.

The right type to use in order to enable more platforms to go beyond 4GB
might be to use uintmax_t, but the series you are commenting on however is
not about changing that.

We have another problem stemming from the way in which we incorrectly used
zlib API even on a platform where "unsigned long" is capable to express
size beyond 4GB. In many places, we set up the state object used by zlib
API (i.e. z_stream) to point at the "pointer to the beginning of memory
block" with its "next_in" field, and "length" with its "avail_in" field,
pass that object around in the callchain, and expect that by making
repeated call to zlib, "next_in" would eventually progress to the end of
the data we have in core while "avail_in" would fall to zero when all data
is processed. The "avail_in" field zlib API gives us however is uInt which
is 32-bit, so this expectation is incorrect. If you have 4G+32 bytes of
data, for example, we only feed 32 bytes and stop, barfing on "corrupt"
data.

That is the issue this series is about. The approach of the series takes
is to wrap zlib's state object with our own, that has our own "avail_in"
field (by the way, the same issue exists in "next_out/avail_out" on the
output side) that uses the same type of "length" used in other parts of
our system.

The type of the "avail_in" and "avail_out" fields in the wrapper needs to
be updated to match that type when you address the "other" issue to update
all the internal "length" from "unsigned long" to "uintmax_t", but not
before. And updating the rest of the system to "uintmax_t" is not part of
the scope of this series.