From: Elia Pinto Date: Fri, 30 Oct 2026 10:28:39 GMT Subject: [PATCH 6/6] diff: use size_t in count_trailing_blank() Message-ID: <79f1781abdd196ac35ae888ea5470705c56eaa4a.1793355390.git.gitter.spiros@gmail.com> In-Reply-To: Since 3c7a31204f (xdiff: use size_t for buffer sizes, 2026-09-30), mmfile_t stores its size as a size_t, but count_trailing_blank() still copies it into a "long". On platforms where "long" is 32 bits wide, like Windows, a buffer between 2GiB and 4GiB gives a negative size, and "ptr += size - 1" points about 2GiB before the start of the buffer, which we then dereference. check_blank_at_eof() calls this function whenever the whitespace rule includes blank-at-eof, which is the default, and it does so before xdi_diff() rejects inputs larger than MAX_XDIFF_SIZE. Large files are normally treated as binary and never get here, but a "diff" attribute or a textconv driver makes us diff them as text. A repository can ship such an attribute in its .gitattributes, so "git show" or "git log -p" on a commit adding a 3GiB file can be made to crash. Use size_t; the rest of the function works unchanged with it. No test, as triggering this needs a platform with a 32-bit "long" and a blob larger than 2GiB. Signed-off-by: Elia Pinto --- diff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/diff.c b/diff.c index b4ac17f8ef..e42e53d43e 100644 --- a/diff.c +++ b/diff.c @@ -711,7 +711,7 @@ static unsigned long diff_filespec_size(struct repository *r, static int count_trailing_blank(mmfile_t *mf) { char *ptr = mf->ptr; - long size = mf->size; + size_t size = mf->size; int cnt = 0; if (!size) -- 2.53.0