From: Junio C Hamano <junkio@cox.net>
Date: Thu, 06 Oct 2005 22:37:40 GMT
Subject: Re: Still unsafe: write_sha1_from_fd()
Message-ID: <7vvf0a5l1n.fsf@assigned-by-dhcp.cox.net>
In-Reply-To: <Pine.LNX.4.64.0510061520400.31407@g5.osdl.org>

Linus Torvalds <torvalds@osdl.org> writes:

> The only user is apparently ssh-fetch, but especially since the input-fd 
> is a network connection, it looks like it is not at all unlikely that this 
> case will trigger - all it takes is somebody impatient waiting for a large 
> object.
>
> Ugh,

Ugh indeed.

I'd vote for renaming it to a less generic name, moving it out
of sha1_file.c -- make it static in ssh-fetch.c -- and slowly
deprecate the use of ssh-fetch/ssh-upload pair.

I do not see much point prefering it over the pack transfer
protocol anyway, if you already have ssh access to the box.