From: Junio C Hamano Date: Thu, 13 Oct 2005 07:11:07 GMT Subject: Re: diff_tree_stdin Message-ID: <7vu0fl51tg.fsf@assigned-by-dhcp.cox.net> In-Reply-To: <118833cc0510111846q42c5d7e5j162bdacd49dfebbc@mail.gmail.com> Morten Welinder writes: > It looks like diff_tree_stdin can overrun the this_header buffer. Since the > line length is already calculated, a check would be cheap. I presume you are talking about "line", not this_header[], since you are talking about something whose length is already calculated. The output buffer this_header[] only ever gets two 40-byte SHA1 and a handful more, so probably 128 bytes would be big enough -- the current 1000 is overkill. The input line[] is first NUL terminated before getting scanned, and scanning with get_sha1_hex() stops immediately when we see NUL, and premature NUL makes it fail, so the first get_sha1_hex() would not overrun. If the first SHA1 is followed by garbage then the second get_sha1_hex() would not succeed without overrunning either. If line[40] is NUL then we do not even do the second get_sha1_hex() --- in any case I do not see overrun. I am getting tired (it _was_ my GIT day, but unfortunately I had to be worried about another day-job project during the day X-<), and I might probably be overlooking something fairly obvious to you. Care to explain?