[PATCH 4/4] tag, fmt-merge-msg, ref-filter: use size_t for message buffers
- From
Elia Pinto <gitter.spiros@gmail.com>
- Date
- Oct 31, 2026, 11:10 UTC
- Message-ID
- <7008380756525a72d292a473613a7b3d9dd5d8d4.1793444420.git.gitter.spiros@gmail.com>
- In-Reply-To
- <cover.1793444420.git.gitter.spiros@gmail.com>
Functions like run_gpg_verify(), fmt_tag_signature(), copy_subject(), and append_lines() take the length of a tag or message as an "unsigned long", while callers pass a size_t. On platforms where "long" is 32 bits, this truncates the length for objects of 4GiB or more.
When handling large tags or messages on those platforms, "git tag -v" inspects only a prefix and fails to find the signature placed at the end of the tag. Additionally, in copy_subject(), the loop index is an "int", causing an overflow on subjects of 2GiB or more across all platforms.
Use size_t for the length parameters and the loop index.
Triggering this requires processing 2GiB or 4GiB or more of input, so no test is added.
Signed-off-by: Elia Pinto <gitter.spiros@gmail.com> --- fmt-merge-msg.c | 2 +- ref-filter.c | 6 +++--- tag.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/fmt-merge-msg.c b/fmt-merge-msg.c index 14441f23ae..5a96c50383 100644 --- a/fmt-merge-msg.c +++ b/fmt-merge-msg.c @@ -505,7 +505,7 @@ static void fmt_merge_msg_title(struct strbuf *out, static void fmt_tag_signature(struct strbuf *tagbuf, struct strbuf *sig, const char *buf, - unsigned long len) + size_t len) { const char *tag_body = strstr(buf, "\n\n"); if (tag_body) { diff --git a/ref-filter.c b/ref-filter.c index bdf54f6f59..8e2dcb74b0 100644 --- a/ref-filter.c +++ b/ref-filter.c @@ -1657,10 +1657,10 @@ static const char *copy_email(const char *buf, struct used_atom *atom) return xmemdupz(email, eoemail - email); } -static char *copy_subject(const char *buf, unsigned long len) +static char *copy_subject(const char *buf, size_t len) { struct strbuf sb = STRBUF_INIT; - int i; + size_t i; for (i = 0; i < len; i++) { if (buf[i] == '\r' && i + 1 < len && buf[i + 1] == '\n') @@ -1952,7 +1952,7 @@ static void find_subpos(const char *buf, * If 'lines' is greater than 0, append that many lines from the given * 'buf' of length 'size' to the given strbuf. */ -static void append_lines(struct strbuf *out, const char *buf, unsigned long size, int lines) +static void append_lines(struct strbuf *out, const char *buf, size_t size, int lines) { int i; const char *sp, *eol; diff --git a/tag.c b/tag.c index 414681c64f..8709e8c46d 100644 --- a/tag.c +++ b/tag.c @@ -16,7 +16,7 @@ const char *tag_type = "tag"; -static int run_gpg_verify(const char *buf, unsigned long size, unsigned flags) +static int run_gpg_verify(const char *buf, size_t size, unsigned flags) { struct signature_check sigc; struct strbuf payload = STRBUF_INIT;
-- 2.53.0