From: Junio C Hamano <gitster@pobox.com>
Date: Wed, 05 Oct 2011 20:37:40 GMT
Subject: Re: [PATCH 1/1] get_sha1_hex(): do not read past a NUL character
Message-ID: <7v39f76up7.fsf@alter.siamese.dyndns.org>
In-Reply-To: <201110052111.52701.trast@student.ethz.ch>

Thomas Rast <trast@student.ethz.ch> writes:

> Junio C Hamano wrote:
>> Michael Haggerty <mhagger@alum.mit.edu> writes:
>> 
>> > Previously, get_sha1_hex() would read one character past the end of a
>> > null-terminated string whose strlen was an even number less than 40.
>> > Although the function correctly returned -1 in these cases, the extra
>> > memory access might have been to uninitialized (or even, conceivably,
>> > unallocated) memory.
>> >
>> > Add a check to avoid reading past the end of a string.
>> 
>> Makes sense; thanks.
>
> Has this fixed patch ever made it to pu?  I'm still seeing the same
> breakage in the automated valgrind runs.

I do not think so.

I was under the impression that Michael wanted to include this in the
early part of a re-roll of check-ref-format series.

I'll do the rebase myself. Thanks.