{"thread":{"id":"2083","subject":"diff_tree_stdin","startedAt":"2005-10-12T01:46:38Z","lastAt":"2005-10-13T15:01:12Z","messageCount":3,"participants":["Morten Welinder","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"10045","messageId":"118833cc0510111846q42c5d7e5j162bdacd49dfebbc@mail.gmail.com","threadId":"2083","inReplyTo":null,"subject":"diff_tree_stdin","fromName":"Morten Welinder","fromEmail":"mwelinder@gmail.com","sentAt":"2005-10-12T01:46:38Z","receivedAt":"2005-10-12T01:46:38Z","isPatch":false,"sender":{"key":"mwelinder@gmail.com","avatar":null},"body":"It looks like diff_tree_stdin can overrun the this_header buffer.  Since the\nline length is already calculated, a check would be cheap.\n\nMorten\n"},{"id":"10056","messageId":"7vu0fl51tg.fsf@assigned-by-dhcp.cox.net","threadId":"2083","inReplyTo":"118833cc0510111846q42c5d7e5j162bdacd49dfebbc@mail.gmail.com","subject":"Re: diff_tree_stdin","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2005-10-13T07:11:07Z","receivedAt":"2005-10-13T07:11:07Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Morten Welinder <mwelinder@gmail.com> writes:\n\n> It looks like diff_tree_stdin can overrun the this_header buffer.  Since the\n> line length is already calculated, a check would be cheap.\n\nI presume you are talking about \"line\", not this_header[], since\nyou are talking about something whose length is already\ncalculated.\n\nThe output buffer this_header[] only ever gets two 40-byte SHA1\nand a handful more, so probably 128 bytes would be big enough --\nthe current 1000 is overkill.\n\nThe input line[] is first NUL terminated before getting scanned,\nand scanning with get_sha1_hex() stops immediately when we see\nNUL, and premature NUL makes it fail, so the first\nget_sha1_hex() would not overrun.  If the first SHA1 is followed\nby garbage then the second get_sha1_hex() would not succeed\nwithout overrunning either.  If line[40] is NUL then we do not\neven do the second get_sha1_hex() --- in any case I do not see\noverrun.\n\nI am getting tired (it _was_ my GIT day, but unfortunately I had\nto be worried about another day-job project during the day X-<),\nand I might probably be overlooking something fairly obvious to\nyou.  Care to explain?\n"},{"id":"10066","messageId":"118833cc0510130801w2e900d9cr79c9666d536ef5b7@mail.gmail.com","threadId":"2083","inReplyTo":"7vu0fl51tg.fsf@assigned-by-dhcp.cox.net","subject":"Re: diff_tree_stdin","fromName":"Morten Welinder","fromEmail":"mwelinder@gmail.com","sentAt":"2005-10-13T15:01:12Z","receivedAt":"2005-10-13T15:01:12Z","isPatch":false,"sender":{"key":"mwelinder@gmail.com","avatar":null},"body":"> I presume you are talking about \"line\", not this_header[], since\n> you are talking about something whose length is already\n> calculated.\n\nI was talking about this_header.  It gets slightly more than the length\nof \"line\" which is whatever came in from stdin, subject to a 1000 char\nlimit.\n\nMorten\n"}]}