Re: [PATCH 00/14] numparse module: systematically tighten up integer parsing
- From
Jeff King <peff@peff.net>
- Date
- Mar 18, 2015, 10:03 UTC
- Message-ID
- <20150318100338.GA26998@peff.net>
- In-Reply-To
- <550949BC.1020500@alum.mit.edu>
On Wed, Mar 18, 2015 at 10:47:40AM +0100, Michael Haggerty wrote:
Show 8 quoted lines
> But in case you have some reason that you want upload-pack.c to be > converted right away, I just pushed that change (plus some related > cleanups) to my GitHub repo [1]. The branch depends only on the first > patch of the "numparse" patch series. > > By the way, some other packet line parsing code in that file doesn't > verify that there are no trailing characters on the lines that they > process. That might be another thing that should be tightened up.
Do you mean that upload-pack gets a pkt-line of length N that contains a line of length M, and then doesn't check that M==N? We use the space between M and N for passing capabilities and other metadata around.
Or do you mean that we see lines like:
want [0-9a-f]{40} ...\nand do not bother looking at the "..." that comes after the data we expect? That I can believe, and I don't think it would hurt to tighten up (we shouldn't need it for extensibility, as anybody trying to stick extra data there should do so only after using a capability flag earlier in the protocol).
-Peff