fix: decode quoted diff paths in one pass

<!-- agent -->
GHSA-v6xg-m7rh-r365 (closed) reports that quoted patch paths can crash or
silently change when an escaped literal backslash precedes digits.

Add regression coverage distinguishing literal backslashes from real
octal byte escapes, then decode Git's C-style quoting sequentially so
one escape cannot be reinterpreted by a later pass. Match Git baseline
cf5497b14c5a24f10c13f7e0ee85cb95af13ea6a quote.c::unquote_c_style by
accepting octal bytes only when all three digits are valid and the first
is 0 through 3.

Assisted-by: GPT 5.6
Co-authored-by: GPT 5.6 <codex@openai.com>

Author: Byron

git/diff.py

@@ -95,24 +95,43 @@ class DiffConstants(enum.Enum):
 :const:`git.INDEX` and :const:`Diffable.INDEX`, as well as :const:`Diffable.Index`.
 """
 
-_octal_byte_re = re.compile(rb"\\([0-9]{3})")
 
-
-def _octal_repl(matchobj: Match) -> bytes:
-    value = matchobj.group(1)
-    value = int(value, 8)
-    value = bytes(bytearray((value,)))
-    return value
+def _unquote_path(path: bytes) -> bytes:
+    result = bytearray()
+    escapes = {
+        ord("a"): 7,
+        ord("b"): 8,
+        ord("f"): 12,
+        ord("n"): 10,
+        ord("r"): 13,
+        ord("t"): 9,
+        ord("v"): 11,
+    }
+    i = 0
+    while i < len(path):
+        if path[i] != ord("\\") or i + 1 == len(path):
+            result.append(path[i])
+            i += 1
+            continue
+        if path[i + 1] in b"0123" and i + 3 < len(path) and all(c in b"01234567" for c in path[i + 2 : i + 4]):
+            result.append(int(path[i + 1 : i + 4], 8))
+            i += 4
+            continue
+        escaped = path[i + 1]
+        if escaped in escapes or escaped in b'\\"':
+            result.append(escapes.get(escaped, escaped))
+        else:
+            result.extend(path[i : i + 2])
+        i += 2
+    return bytes(result)
 
 
 def decode_path(path: bytes, has_ab_prefix: bool = True) -> Optional[bytes]:
     if path == b"/dev/null":
         return None
 
     if path.startswith(b'"') and path.endswith(b'"'):
-        path = path[1:-1].replace(b"\\n", b"\n").replace(b"\\t", b"\t").replace(b'\\"', b'"').replace(b"\\\\", b"\\")
-
-    path = _octal_byte_re.sub(_octal_repl, path)
+        path = _unquote_path(path[1:-1])
 
     if has_ab_prefix:
         assert path.startswith(b"a/") or path.startswith(b"b/")

test/test_diff.py

@@ -14,6 +14,7 @@
 
 from git import NULL_TREE, Diff, DiffIndex, Diffable, GitCommandError, Repo, Submodule
 from git.cmd import Git
+from git.diff import decode_path
 from git.exc import UnsafeOptionError
 
 from test.lib import StringProcessAdapter, TestBase, fixture, with_rw_directory
@@ -324,6 +325,11 @@ def test_diff_patch_format(self):
             Diff._index_from_patch_format(self.rorepo, diff_proc)
         # END for each fixture
 
+    def test_decode_path_distinguishes_escaped_backslashes_from_octal_bytes(self):
+        self.assertEqual(decode_path(b'"foo\\\\899bar"', False), b"foo\\899bar")
+        self.assertEqual(decode_path(b'"foo\\\\123bar"', False), b"foo\\123bar")
+        self.assertEqual(decode_path(b'"foo\\123bar"', False), b"fooSbar")
+
     def test_diff_with_spaces(self):
         data = StringProcessAdapter(fixture("diff_file_with_spaces"))
         diff_index = Diff._index_from_patch_format(self.rorepo, data)