git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 0/4] use size_t when parsing and checking objects

From
Elia Pinto <gitter.spiros@gmail.com>
Date
Oct 31, 2026, 11:09 UTC
Message-ID
<cover.1793444420.git.gitter.spiros@gmail.com>

This series continues the search for truncated sizes on platforms where "long" is 32 bits (Windows). It covers the functions that parse, verify, and check whole objects in memory: they take the size as an "unsigned long", while their callers have a size_t, so above 4GiB the size gets truncated.

Each patch addresses a specific component:
 - 1/4: a valid object reported as corrupt;
 - 2/4: fsck looks at only a prefix (e.g., .gitmodules);
 - 3/4: parsing of a prefix (with set_commit_buffer() now dying instead
   of caching a truncated size, as repo_get_commit_buffer() already
   does);
 - 4/4: "git tag -v" doesn't find the signature, plus the int index in
   copy_subject() on all platforms.

There are no out-of-bounds accesses; large objects only fail or are handled as if they were shorter.

No tests are added because they would need objects over 4GiB in memory, and they'd only detect the bug where long is 32 bits. I am happy to add EXPENSIVE tests guarded by !LONG_IS_64BIT (like t1051) if reviewers prefer.

Not covered here: the pack paths (index-pack, unpack-objects, pack
verification) still pass an "unsigned long" to fsck_object(); that's the
next series. The tree API (parse_tree_buffer(), init_tree_desc*()) is in
the tree-walk series:
  https://lore.kernel.org/git/cover.1793357680.git.gitter.spiros@gmail.com/
This series doesn't depend on the other series in flight and merges
cleanly with them. Based on master 50fe5cc63f.
Elia Pinto (4):
  object-file: use size_t in check_object_signature()
  fsck: use size_t for the size of objects to check
  object, commit, tag: use size_t when parsing object buffers
  tag, fmt-merge-msg, ref-filter: use size_t for message buffers
 commit.c              |  8 ++++----
 commit.h              |  6 +++---
 fmt-merge-msg.c       |  2 +-
 fsck.c                | 18 +++++++++---------
 fsck.h                |  6 +++---
 object-file-convert.c |  2 +-
 object-file.c         |  2 +-
 object-file.h         |  2 +-
 object.c              |  2 +-
 object.h              |  2 +-
 ref-filter.c          |  6 +++---
 tag.c                 |  4 ++--
 tag.h                 |  2 +-
 13 files changed, 31 insertions(+), 31 deletions(-)
base-commit: 50fe5cc63f9cd6e89b87a2c9ccf96a444f4cfdb7
-- 
2.53.0
Next: Elia Pinto
Message 1 of 7 in “use size_t when parsing and checking objects”
  1. 0/4 use size_t when parsing and checking objectsElia Pinto, Oct 31, 2026
  2. 1/4 object-file: use size_t in check_object_signature()Elia Pinto, Oct 31, 2026
  3. 2/4 fsck: use size_t for the size of objects to checkElia Pinto, Oct 31, 2026
  4. 3/4 object, commit, tag: use size_t when parsing object buffersElia Pinto, Oct 31, 2026
  5. 4/4 tag, fmt-merge-msg, ref-filter: use size_t for message buffersElia Pinto, Oct 31, 2026
  6. Simon RichterOct 31, 2026
  7. Elia PintoOct 31, 2026

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.