Error 500 on specific commits replacing backslash by slash

[Noctisae]

• Gitea version (or commit ref): 1.10.0
• Git version: 1.8.3.1-6
• Operating system: CentOS 7
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL) : https://try.gitea.io/Noctisae/testing/commit/c81652a490f6d75c3db7c3213170dbd485d84ecf
  • No
  • Not relevant
• Log gist:

2020/08/20 18:24:07 ...les/context/panic.go:35:1() [E] PANIC:: runtime error: slice bounds out of range [:-1]
        /usr/local/go/src/runtime/panic.go:85 (0x43bee2)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/services/gitdiff/gitdiff.go:561 (0x11657af)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/services/gitdiff/gitdiff.go:720 (0x1165d68)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/services/gitdiff/gitdiff.go:670 (0x12a43aa)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/routers/repo/compare.go:281 (0x12a42ff)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/routers/repo/compare.go:357 (0x12a5582)
        /usr/local/go/src/reflect/value.go:460 (0x49e675)
        /usr/local/go/src/reflect/value.go:321 (0x49de33)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:177 (0x9b3869)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:137 (0x9b3219)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:121 (0x9e2ba8)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:112 (0x113ed4e)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/modules/context/repo.go:500 (0x113ed37)
        /usr/local/go/src/reflect/value.go:460 (0x49e675)
        /usr/local/go/src/reflect/value.go:321 (0x49de33)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:177 (0x9b3869)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:137 (0x9b3219)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:121 (0x9e2ba8)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:112 (0x113c6e1)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/modules/context/panic.go:39 (0x113c6cd)
        /usr/local/go/src/reflect/value.go:460 (0x49e675)
        /usr/local/go/src/reflect/value.go:321 (0x49de33)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:177 (0x9b3869)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:137 (0x9b3219)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:121 (0x9e2ba8)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:112 (0xab01b5)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/session/session.go:192 (0xab01a0)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:79 (0x9e2a50)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:157 (0x9b3579)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:135 (0x9b3308)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:121 (0x9e2ba8)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:112 (0x9f4249)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/recovery.go:161 (0x9f4237)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/logger.go:40 (0x9e6723)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:157 (0x9b3579)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:135 (0x9b3308)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:121 (0x9e2ba8)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:112 (0x9f3580)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/logger.go:52 (0x9f356b)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/logger.go:40 (0x9e6723)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:157 (0x9b3579)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/inject/inject.go:135 (0x9b3308)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/context.go:121 (0x9e2ba8)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/router.go:187 (0x9f5466)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/router.go:303 (0x9eee45)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/gitea.com/macaron/macaron/macaron.go:220 (0x9e7aba)
        /home/francois/dev_gitea/final_generation/src/code.gitea.io/gitea/vendor/github.com/gorilla/context/context.go:141 (0xc4db3d)
        /usr/local/go/src/net/http/server.go:2007 (0x75f423)
        /usr/local/go/src/net/http/server.go:2802 (0x762873)
        /usr/local/go/src/net/http/server.go:1890 (0x75e214)
        /usr/local/go/src/runtime/asm_amd64.s:1357 (0x46da50)

Description

I'm getting a reproductible 500 error when Gitea tries to show and parses a certain type of commit.

The process I found to reproduce this error is this one:

• Inside a branch of a repository, clic on "New file";
• Name the file with Windows-style backslash (exemple : "testing\test.test"), and put some content in it. The file now exists in the repo, but not in a folder, as per the backslash;
• In a new commit, rename the file by replacing the backslash by a slash. In my setup, "testing\test.test" becomes "testing/test.test". Gitea now display the folder, and the file in it;
• Display the commits of the branch, and click on the commit updating the file -> 500 error code (exemple on try.gitea.io : https://try.gitea.io/Noctisae/testing/commit/c81652a490f6d75c3db7c3213170dbd485d84ecf)

I traced back the error to this part of code in my version of Gitea, in the file "services\gitdiff\gitdiff.go" :

			// Note: In case file name is surrounded by double quotes (it happens only in git-shell).
			// e.g. diff --git "a/xxx" "b/xxx"
			hasQuote := line[len(cmdDiffHead)] == '"'
			if hasQuote {
				middle = strings.Index(line, ` "b/`)
			} else {
				middle = strings.Index(line, " b/")
			}

			beg := len(cmdDiffHead)
			a := line[beg+2 : middle]   <== line bringing out the error
			b := line[middle+3:]

From what I understand of the code involved in the error, it seems there is a problem when a diff file contains multiples "types" of "diff --git " lines (with and without doubles quotes), as the git diff of the commit replacing the backslash by a slash which brings out the error contains both :

• a 'diff --git a/testing/test.test b/testing/test.test' line
• a 'diff --git "a/testing\\test.test" "b/testing\\test.test"' line

Side note : After this bug occurs, pull requests doesn't works anymore on my gitea for the repository containing the commit, between the dev branch (containing the offending commit) and the master branch. I have not been able to reproduce it on try.gitea.io, but I guess it is a side effect ?