Re: [PATCH 2/3] prune_object_dir(): verify that path fits in the temporary buffer

> Dimension the buffer based on PATH_MAX rather than a magic number, and
> verify that the path fits in it before continuing.
>
> Signed-off-by: Michael Haggerty <mhagger@alum.mit.edu>
> ---
>
> I don't think that this problem is remotely exploitable, because the
> size of the string doesn't depend on inputs that can be influenced by
> a client (at least not within Git).
>
>  builtin/prune.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/builtin/prune.c b/builtin/prune.c
> index 6366917..ae34d04 100644
> --- a/builtin/prune.c
> +++ b/builtin/prune.c
> @@ -96,7 +96,9 @@ static void prune_object_dir(const char *path)
>  {
>         int i;
>         for (i = 0; i < 256; i++) {
> -               static char dir[4096];
> +               static char dir[PATH_MAX + 1];
> +               if (strlen(path) + 3 > PATH_MAX)
> +                       die("impossible object directory");
>                 sprintf(dir, "%s/%02x", path, i);
>                 prune_dir(i, dir);
>         }
> --
> 1.8.5.1