git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Still unsafe: write_sha1_from_fd()

From
Junio C Hamano <junkio@cox.net>
Date
Oct 6, 2005, 22:37 UTC
Message-ID
<7vvf0a5l1n.fsf@assigned-by-dhcp.cox.net>
In-Reply-To
<Pine.LNX.4.64.0510061520400.31407@g5.osdl.org>
Linus Torvalds <torvalds@osdl.org> writes:
Show 6 quoted lines
> The only user is apparently ssh-fetch, but especially since the input-fd 
> is a network connection, it looks like it is not at all unlikely that this 
> case will trigger - all it takes is somebody impatient waiting for a large 
> object.
>
> Ugh,
Ugh indeed.

I'd vote for renaming it to a less generic name, moving it out of sha1_file.c -- make it static in ssh-fetch.c -- and slowly deprecate the use of ssh-fetch/ssh-upload pair.

I do not see much point prefering it over the pack transfer protocol anyway, if you already have ssh access to the box.

Previous: Linus Torvalds
Message 2 of 2 in “Still unsafe: write_sha1_from_fd()”
  1. Linus TorvaldsOct 6, 2005
  2. Junio C HamanoOct 6, 2005

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.