git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 2/5] http: use `size_t` for byte position in fwrite_sha1_file

From
Patrick Steinhardt <ps@pks.im>
Date
Oct 16, 2026, 08:38 UTC
Message-ID
<atHiiye4oi_lF5FP@pks.im>
In-Reply-To
<70a909de18e8cd8d282439fb51a9399baa8c7be8.1791958171.git.gitgitgadget@gmail.com>
On Wed, Oct 14, 2026 at 06:09:28AM +0000, Johannes Schindelin via GitGitGadget wrote:
Show 12 quoted lines
> diff --git a/http.c b/http.c
> index 4af3c29c76..809471f436 100644
> --- a/http.c
> +++ b/http.c
> @@ -2848,7 +2848,7 @@ static size_t fwrite_sha1_file(char *ptr, size_t eltsize, size_t nmemb,
>  {
>  	unsigned char expn[4096];
>  	size_t size = eltsize * nmemb;
> -	int posn = 0;
> +	size_t posn = 0;
>  	struct http_object_request *freq = data;
>  	struct active_request_slot *slot = freq->slot;
Right. This is how we access the variable:
	do {
		ssize_t retval = xwrite(freq->localfile,
					(char *) ptr + posn, size - posn);
		if (retval < 0)
			return posn / eltsize;
		posn += retval;
	} while (posn < size);

So it's clear that it doesn't have to be signed either, as we only ever add positive values to it.

Patrick
Previous: Johannes Schindelin via GitGitGadgetNext: Junio C Hamano
Message 4 of 16 in “Address overflows pointed out by Coverity”
  1. 0/5 Address overflows pointed out by CoverityJohannes Schindelin via GitGitGadget, Oct 14, 2026
  2. 1/5 archive-tar: guard get_path_prefix against zero-length inputJohannes Schindelin via GitGitGadget, Oct 14, 2026
  3. 2/5 http: use `size_t` for byte position in fwrite_sha1_fileJohannes Schindelin via GitGitGadget, Oct 14, 2026
  4. Patrick SteinhardtOct 16, 2026
  5. Junio C HamanoOct 16, 2026
  6. Simon RichterOct 17, 2026
  7. Junio C HamanoOct 17, 2026
  8. Junio C HamanoOct 17, 2026
  9. 3/5 wrapper: reject insanely large byte counts when reading/writingJohannes Schindelin via GitGitGadget, Oct 14, 2026
  10. Phillip WoodOct 14, 2026
  11. 4/5 git-compat-util: add `signed_mult_overflows` and `mult_overflows` macrosJohannes Schindelin via GitGitGadget, Oct 14, 2026
  12. Phillip WoodOct 15, 2026
  13. 5/5 date: avoid overflow in approxidate relative-time multiplicationJohannes Schindelin via GitGitGadget, Oct 14, 2026
  14. Junio C HamanoOct 14, 2026
  15. Phillip WoodOct 15, 2026
  16. Harald NordgrenOct 16, 2026

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.