From: Junio C Hamano Date: Sun, 07 Jun 2009 20:29:16 GMT Subject: Re: [PATCH] daemon: Skip unknown "extra arg" information Message-ID: <7vfxebaiub.fsf@alter.siamese.dyndns.org> In-Reply-To: <200906072056.08680.j6t@kdbg.org> Johannes Sixt writes: > On Freitag, 5. Juni 2009, Shawn O. Pearce wrote: >> Actually, we're already f'kd. We can't change the protocol like >> we had hoped. I still think this should go in maint. >> >> --8<-- >> daemon: Strictly parse the "extra arg" part of the command >> >> Since 1.4.4.5 (49ba83fb67 "Add virtualization support to git-daemon") >> git daemon enters an infinite loop and never terminates if a client >> hides any extra arguments in the initial request line which is not >> exactly "\0host=blah\0". > > I see you applied this to maint. Since this patch actually fixes a > DoS-exploitable bug, shouldn't it be applied all the way back to 1.4.4.5? I personally do not have the bandwidth to worry about anything older than say 1.6.0. Interested parties (read: distro packagers who pride themselves for their LTS) can do that themselves.