range-diff: add early size check to prevent long delays

When range-diff is given very large ranges (e.g., 250,000+ commits),
it takes an extremely long time in read_patches() before eventually
hitting memory or overflow issues. This provides a poor user experience
as the command appears to hang.

Add an early size check using 'git rev-list --count' to quickly count
commits in both ranges before attempting to read all patches. This
check typically completes in ~1 second even for ranges with hundreds
of thousands of commits, compared to read_patches() which times out
after many seconds.

The limit of 10,000 total commits is generous for real-world use cases
(even large refactoring series rarely exceed 1,000 commits) while
preventing impractical operations that would require gigabytes of memory
for the cost matrix.

When the limit is exceeded, range-diff now immediately returns a clear
error message rather than appearing to hang. The existing check in
get_correspondences() is retained as defense in depth.

This improves the user experience from:
- Wait 5+ seconds (or longer) for read_patches() to process
- Eventually crash or hang

To:
- Get an immediate error message in ~1 second
- Clear explanation of the problem

Signed-off-by: Paulo Casaretto <[email protected]>
Signed-off-by: pcasaretto <[email protected]>

Author: pcasaretto

range-diff.c

@@ -21,6 +21,13 @@
 #include "apply.h"
 #include "revision.h"
 
+/*
+ * Maximum total patches (a->nr + b->nr) for range-diff to prevent
+ * unreasonable memory usage. This allows up to 10,000 total patches
+ * which uses ~400MB for the cost matrix.
+ */
+#define MAX_RANGE_DIFF_TOTAL_PATCHES 10000
+
 struct patch_util {
 	/* For the search for an exact match */
 	struct hashmap_entry e;
@@ -324,13 +331,18 @@ static int diffsize(const char *a, const char *b)
 	return COST_MAX;
 }
 
-static void get_correspondences(struct string_list *a, struct string_list *b,
+static int get_correspondences(struct string_list *a, struct string_list *b,
 				int creation_factor)
 {
 	int n = a->nr + b->nr;
 	int *cost, c, *a2b, *b2a;
 	int i, j;
 
+	/* Check for unreasonably large ranges */
+	if (n > MAX_RANGE_DIFF_TOTAL_PATCHES)
+		return error(_("ranges too large for range-diff: %d total patches (max: %d)"),
+			     n, MAX_RANGE_DIFF_TOTAL_PATCHES);
+
 	ALLOC_ARRAY(cost, st_mult(n, n));
 	ALLOC_ARRAY(a2b, n);
 	ALLOC_ARRAY(b2a, n);
@@ -383,6 +395,8 @@ static void get_correspondences(struct string_list *a, struct string_list *b,
 	free(cost);
 	free(a2b);
 	free(b2a);
+
+	return 0;
 }
 
 static void output_pair_header(struct diff_options *diffopt,
@@ -492,6 +506,33 @@ static const char *output_prefix_cb(struct diff_options *opt UNUSED, void *data)
 	return data;
 }
 
+static int count_range_commits(const char *range)
+{
+	struct child_process cp = CHILD_PROCESS_INIT;
+	struct strbuf buf = STRBUF_INIT;
+	int count = -1;
+
+	strvec_pushl(&cp.args, "rev-list", "--count", range, NULL);
+	cp.git_cmd = 1;
+	cp.no_stdin = 1;
+	cp.out = -1;
+
+	if (start_command(&cp))
+		return -1;
+
+	if (strbuf_read(&buf, cp.out, 0) >= 0) {
+		char *end;
+		count = strtol(buf.buf, &end, 10);
+		if (*end && *end != '\n')
+			count = -1;
+	}
+
+	finish_command(&cp);
+	strbuf_release(&buf);
+
+	return count;
+}
+
 static void output(struct string_list *a, struct string_list *b,
 		   struct range_diff_options *range_diff_opts)
 {
@@ -575,6 +616,7 @@ int show_range_diff(const char *range1, const char *range2,
 		    struct range_diff_options *range_diff_opts)
 {
 	int res = 0;
+	int count1, count2, total;
 
 	struct string_list branch1 = STRING_LIST_INIT_DUP;
 	struct string_list branch2 = STRING_LIST_INIT_DUP;
@@ -583,16 +625,34 @@ int show_range_diff(const char *range1, const char *range2,
 	if (range_diff_opts->left_only && range_diff_opts->right_only)
 		res = error(_("options '%s' and '%s' cannot be used together"), "--left-only", "--right-only");
 
+	/* Check range sizes early before reading patches */
+	if (!res) {
+		count1 = count_range_commits(range1);
+		count2 = count_range_commits(range2);
+
+		if (count1 < 0)
+			res = error(_("could not count commits in range '%s'"), range1);
+		else if (count2 < 0)
+			res = error(_("could not count commits in range '%s'"), range2);
+		else {
+			total = count1 + count2;
+			if (total > MAX_RANGE_DIFF_TOTAL_PATCHES)
+				res = error(_("ranges too large for range-diff: %d total commits (max: %d)"),
+					    total, MAX_RANGE_DIFF_TOTAL_PATCHES);
+		}
+	}
+
 	if (!res && read_patches(range1, &branch1, range_diff_opts->other_arg, include_merges))
 		res = error(_("could not parse log for '%s'"), range1);
 	if (!res && read_patches(range2, &branch2, range_diff_opts->other_arg, include_merges))
 		res = error(_("could not parse log for '%s'"), range2);
 
 	if (!res) {
 		find_exact_matches(&branch1, &branch2);
-		get_correspondences(&branch1, &branch2,
-				    range_diff_opts->creation_factor);
-		output(&branch1, &branch2, range_diff_opts);
+		res = get_correspondences(&branch1, &branch2,
+					  range_diff_opts->creation_factor);
+		if (!res)
+			output(&branch1, &branch2, range_diff_opts);
 	}
 
 	string_list_clear(&branch1, 1);