unpack_entry: avoid freeing objects in base cache

In the !delta_data error path of unpack_entry(), we run free(base).
This became a window for use-after-free() in abe601b (sha1_file:
remove recursion in unpack_entry, 2013-03-27), as follows:

Before abe601b, we got the 'base' from cache_or_unpack_entry(..., 0);
keep_cache=0 tells it to also remove that entry.  So the 'base' is at
this point not cached, and freeing it in the error path is the right
thing.

After abe601b, the structure changed: we use a three-phase approach
where phase 1 finds the innermost base or a base that is already in
the cache.  In phase 3 we therefore know that all bases we unpack are
not part of the delta cache yet.  (Observe that we pop from the cache
in phase 1, so this is also true for the very first base.)  So we make
no further attempts to look up the bases in the cache, and just call
add_delta_base_cache() on every base object we have assembled.

But the !delta_data error path remained unchanged, and now calls
free() on a base that has already been entered in the cache.  This
means that there is a use-after-free if we later use the same base
again.

So remove that free(); we are still going to use that data.

Reported-by: Nguyễn Thái Ngọc Duy <pclouds@gmail.com>
Signed-off-by: Thomas Rast <trast@inf.ethz.ch>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
t5500: add test for fetching with an unknown 'shallow'

When the client sends a 'shallow' line for an object that the server does
not have, the server should just ignore it and let the client keep that
unknown shallow boundary.

Signed-off-by: Michael Heemskerk <mheemskerk@atlassian.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Documentation/git-commit: Typo under --edit

-C takes a commit object, not a file.

Signed-off-by: Anders Granskogen Bjørnstad <andersgb@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
completion: zsh: don't override suffix on _detault

zsh is smart enough to add the right suffix while completing, there's no
point in trying to do the same as bash.

Signed-off-by: Felipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Merge branch 'jn/glossary-revision' into maint

* jn/glossary-revision:
  glossary: a revision is just a commit
Merge branch 'tr/remote-tighten-commandline-parsing' into maint

* tr/remote-tighten-commandline-parsing:
  remote: 'show' and 'prune' can take more than one remote
  remote: check for superfluous arguments in 'git remote add'
  remote: add a test for extra arguments, according to docs
Sync with maint

* maint:
  completion: zsh: don't override suffix on _detault
  Documentation/git-commit: Typo under --edit
Merge branch 'tr/unpack-entry-use-after-free-fix'

* tr/unpack-entry-use-after-free-fix:
  unpack_entry: avoid freeing objects in base cache
Git 1.8.3-rc1

Signed-off-by: Junio C Hamano <gitster@pobox.com>
Sync with v1.8.3-rc1

* master:
  Git 1.8.3-rc1
  completion: zsh: don't override suffix on _detault
  Documentation/git-commit: Typo under --edit
  unpack_entry: avoid freeing objects in base cache
Merge branch 'mh/fetch-into-shallow' into next

* mh/fetch-into-shallow:
  t5500: add test for fetching with an unknown 'shallow'